SSSD / sssd

A daemon to manage identity, authentication and authorization for centrally-managed systems.
https://sssd.io
GNU General Public License v3.0
608 stars 248 forks source link

Security Vulnerability - Action Required: Integer Overflow to Buffer Overflow vulnerability may in your project #7556

Open Crispy-fried-chicken opened 3 months ago

Crispy-fried-chicken commented 3 months ago

Hi, we have detected that your project may be vulnerable to Integer Overflow to Buffer Overflow in the function of free_args in the file of src/util/util.c . It shares similarities to a recent CVE disclosure CVE-2024-6381 in the mongo-c-driver.

The source vulnerability information is as follows:

Vulnerability Detail: CVE Identifier: CVE-2024-6381 Description: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-6381 Patch: https://github.com/mongodb/mongo-c-driver/commit/effd95c34ad421df94eec7c69236f0e4172552d0

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

alexey-tikhonov commented 3 months ago

Hi,

from your point of view, what is the issue (i.e. what are you going to fix with a PR)?

Crispy-fried-chicken commented 3 months ago

@alexey-tikhonov Hi, maybe I'm going to fix it by using pointer-based iteration just like the fix in https://github.com/mongodb/mongo-c-driver/commit/effd95c34ad421df94eec7c69236f0e4172552d0. It may avoid overflow.

alexey-tikhonov commented 3 months ago

Well, the question was "what" is the issue, not "how" to fix it.

I don't think overflow of i in free_args() is a "valid" issue: args are allocated using realloc(ret, (num + 2) * sizeof(char *)); where num is int. So if overflow could happen, it would happen before.

In this sense change of iterator from int to pointer is quite cosmetic but it won't hurt either.

Crispy-fried-chicken commented 3 months ago

I know, but if the num is INT_MAX-2, there is no possibility that the overflow will happen? and there is no need to fix it?

alexey-tikhonov commented 2 months ago

I know, but if the num is INT_MAX-2, there is no possibility that the overflow will happen? and there is no need to fix it?

Sorry I didn't understand this question.

Crispy-fried-chicken commented 2 months ago

I mean there is no need that num is INT_MAX-2?If so, it will be overflow.