glibc/nss/nss_files
Florian Weimer 03d2730b44 CVE-2014-8121: Do not close NSS files database during iteration [BZ #18007]
Robin Hack discovered Samba would enter an infinite loop processing
certain quota-related requests.  We eventually tracked this down to a
glibc issue.

Running a (simplified) test case under strace shows that /etc/passwd
is continuously opened and closed:

…
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
lseek(3, 0, SEEK_CUR)                   = 0
read(3, "root0:0:root:/root:/bin/bash\n"..., 4096) = 2717
lseek(3, 2717, SEEK_SET)                = 2717
close(3)                                = 0
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_SET)                   = 0
read(3, "root0:0:root:/root:/bin/bash\n"..., 4096) = 2717
lseek(3, 2717, SEEK_SET)                = 2717
close(3)                                = 0
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
lseek(3, 0, SEEK_CUR)                   = 0
…

The lookup function implementation in
nss/nss_files/files-XXX.c:DB_LOOKUP has code to prevent that.  It is
supposed skip closing the input file if it was already open.

  /* Reset file pointer to beginning or open file.  */			      \
  status = internal_setent (keep_stream);				      \
									      \
  if (status == NSS_STATUS_SUCCESS)					      \
    {									      \
      /* Tell getent function that we have repositioned the file pointer.  */ \
      last_use = getby;							      \
									      \
      while ((status = internal_getent (result, buffer, buflen, errnop	      \
					H_ERRNO_ARG EXTRA_ARGS_VALUE))	      \
	     == NSS_STATUS_SUCCESS)					      \
	{ break_if_match }						      \
									      \
      if (! keep_stream)						      \
	internal_endent ();						      \
    }									      \

keep_stream is initialized from the stayopen flag in internal_setent.
internal_setent is called from the set*ent implementation as:

  status = internal_setent (stayopen);

However, for non-host database, this flag is always 0, per the
STAYOPEN magic in nss/getXXent_r.c.

Thus, the fix is this:

-  status = internal_setent (stayopen);
+  status = internal_setent (1);

This is not a behavioral change even for the hosts database (where the
application can specify the stayopen flag) because with a call to
sethostent(0), the file handle is still not closed in the
implementation of gethostent.
2015-04-29 14:41:26 +02:00
..
files-alias.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-ethers.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-grp.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-have_o_cloexec.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-hosts.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-init.c Enhance nscd's inotify support (Bug 14906). 2015-03-13 09:49:24 -04:00
files-initgroups.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-key.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-netgrp.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-network.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-parse.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-proto.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-pwd.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-rpc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-service.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-sgrp.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-spwd.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
files-XXX.c CVE-2014-8121: Do not close NSS files database during iteration [BZ #18007] 2015-04-29 14:41:26 +02:00