Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] Prevent rhostname array overflow #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ghsecuritylab
Copy link

This is an automatically generated security fix for a vulnerability detected in your code which is a variant of CVE-2020-8597.

You can read in more detail about this vulnerability in CERT Advisory VU#782301.

The vulnerability occurs because, given that vallen was checked to be less than len, it can never be the case that vallen >= len + sizeof(rhostname). Therefore, rhostname never gets trimmed and the rhostname array may overflow.

While this PR was generated for your project automatically, the supporting analysis was performed and verified by the GitHub Security Lab.

The original finding was reported by Ilja Van Sprundel from IOActive.

The proposed patch was developed by Paul Mackerras (paulusmack) from the Samba project in
paulusmack/ppp@8d7970b#diff-b7f5f2404cf3f5c09b1f8ad9364bb340.

The original vulnerability got assigned CVE-2020-8597 which has a CVSS v3.1 Base Score of 9.8/10.

Source

The source code that generated and submitted this PR is based on JLLeitschuh/bulk-security-pr-generator.

Opting-Out

This bot will respect the ROBOTS.txt format. If you'd like to opt-out of any future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt to your repository with the line:

'''
User-agent: GSL/bulk-security-pr-generator
Disallow: *
'''

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

It is unlikely that we will be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
(see https://developercertificate.org/ for more information).

- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.

be the case that `vallen >= len + sizeof(rhostname)`.

This PR fixes the check so the `rhostname` array does not overflow.

Reported-by: Github Security Lab <[email protected]>
Signed-off-by: Alvaro Muñoz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant