Skip to content
Commit 22955ad8 authored by Siddhesh Poyarekar's avatar Siddhesh Poyarekar
Browse files

tunables: Terminate if end of input is reached (CVE-2023-4911)



The string parsing routine may end up writing beyond bounds of tunestr
if the input tunable string is malformed, of the form name=name=val.
This gets processed twice, first as name=name=val and next as name=val,
resulting in tunestr being name=name=val:name=val, thus overflowing
tunestr.

Terminate the parsing loop at the first instance itself so that tunestr
does not overflow.

This also fixes up tst-env-setuid-tunables to actually handle failures
correct and add new tests to validate the fix for this CVE.

Signed-off-by: default avatarSiddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: default avatarCarlos O'Donell <carlos@redhat.com>
(cherry picked from commit 1056e5b4)
parent 32957eb6
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment