From 232b82afd405c526f822294509e1d32388544ed4 Mon Sep 17 00:00:00 2001 From: Julius Hemanth Pitti Date: Mon, 20 Jul 2020 15:19:46 -0700 Subject: netkit-telnetd: Fix buffer overflow in netoprintf netoprintf() was not handling a case where return value of vsnprintf is greater than "size"(2nd argument), results in buffer overflow while adjusting "nfrontp" pointer to point beyond "netobuf" buffer. Here is one such case where "nfrontp" crossed boundaries of "netobuf", and pointing to another global variable. (gdb) p &netobuf[8255] $5 = 0x55c93afe8b1f "" (gdb) p nfrontp $6 = 0x55c93afe8c20 "\377" (gdb) p &terminaltype $7 = (char **) 0x55c93afe8c20 (gdb) This resulted in crash of telnetd service with segmentation fault. Signed-off-by: Julius Hemanth Pitti Signed-off-by: Khem Raj --- meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb') diff --git a/meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb b/meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb index 0e92add633..08dd532b62 100644 --- a/meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb +++ b/meta-networking/recipes-netkit/netkit-telnet/netkit-telnet_0.17.bb @@ -13,6 +13,7 @@ SRC_URI = "http://ftp.linux.org.uk/pub/linux/Networking/netkit/${BP}.tar.gz \ file://0001-telnet-telnetd-Fix-print-format-strings.patch \ file://0001-telnet-telnetd-Fix-deadlock-on-cleanup.patch \ file://CVE-2020-10188.patch \ + file://0001-telnetd-utility.c-Fix-buffer-overflow-in-netoprintf.patch \ " UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/n/netkit-telnet/" -- cgit v1.2.3-54-g00ecf