jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-18 15:00:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

OPENAFS-SA-2024-002: verify FetchACL returned only a string

Browse Source 
CVE-2024-10396

Supplement the previous commit by additionally verifying that
the returned ACL string occupies the entire XDR opaque, rejecting
any values returned that have an internal NUL prior to the end
of the opaque.

Change-Id: Iefa3d00a9a0e25ef66b7166fe952aae0603ee3d7
Reviewed-on: https://gerrit.openafs.org/15915
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
This commit is contained in:
Benjamin Kaduk 2024-11-04 20:50:50 -08:00
parent 0b1ccb0dbc
commit 7e13414e8e
3 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/WINNT/afsd/cm_ioctl.c
View File

@ -451,6 +451,9 @@ cm_IoctlGetACL(cm_ioctl_t *ioctlp, cm_user_t *userp, cm_scache_t *scp, cm_req_t
if (acl.AFSOpaque_len == 0 || memchr(acl.AFSOpaque_val, '\0',
acl.AFSOpaque_len) == NULL)
return CM_ERROR_INVAL;
/* Reject "strings" with trailing data after the NUL. */
if (strlen(acl.AFSOpaque_val) + 1 != acl.AFSOpaque_len)
return CM_ERROR_INVAL;
}
/* skip over return data */
tlen = (int)strlen(ioctlp->outDatap) + 1;

4
src/afs/afs_pioctl.c
View File

@ -1617,6 +1617,10 @@ DECL_PIOCTL(PGetAcl)
/* Do not return an unterminated ACL string. */
code = EINVAL;
} else if (strlen(acl.AFSOpaque_val) + 1 != acl.AFSOpaque_len) {
/* Do not return an ACL string that has data beyond the trailing NUL. */
code = EINVAL;
} else {
afs_pd_skip(aout, acl.AFSOpaque_len); /* Length of the ACL */
}

4
src/libafscp/afscp_acl.c
View File

@ -64,6 +64,10 @@ afscp_FetchACL(const struct afscp_venusfid *dir, struct AFSOpaque *acl)
code = EIO;
break;
}
if (strlen(acl->AFSOpaque_val) + 1 != acl->AFSOpaque_len) {
code = EIO;
break;
}
}
}
if (code >= 0)