Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix out-of-bounds read (CVE-2018-16866) #23

Merged
merged 2 commits into from
Jan 14, 2019
Merged

Fix out-of-bounds read (CVE-2018-16866) #23

merged 2 commits into from
Jan 14, 2019

Commits on Jan 11, 2019

  1. journal: fix out-of-bounds read CVE-2018-16866 

    The original code didn't account for the fact that strchr() would match on the
'\0' character, making it read past the end of the buffer if no non-whitespace
character was present.

This bug was introduced in commit ec5ff44 which was first released in
systemd v221 and later fixed in commit 8595102 which was released in
v240, so versions in the range [v221, v240) are affected.
    @filbranden
    filbranden committed Jan 11, 2019
    Configuration menu
    Copy the full SHA
    eba87a1 View commit details
    Browse the repository at this point in the history

  2. journal: Add test cases that catch out-of-bounds read in journald 

    The test cases from commit 8595102 check for the return value of
syslog_parse_identifier() and will catch the condition that produced
vulnerability from CVE-2018-16866.

Add these tests to our stable branches.

Tested that these tests will fail if the fix for CVE-2018-16866 is missing
from the branch.
    @filbranden
    filbranden committed Jan 11, 2019
    Configuration menu
    Copy the full SHA
    afc78ce View commit details
    Browse the repository at this point in the history