1. photon
  2. Commit 8b55502a7479dec11e0027ac7d4472ebf1db749c
Browse code

rsyslog: Fix for CVE-2018-16881

Change-Id: Id9cd5a92b1fa63122fc9ec321c63a32ec6e83f98
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6725
Tested-by: michellew <michellew@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

Keerthana K authored on 2019/02/14 19:16:22
Showing 2 changed files
SPECS/rsyslog/CVE-2018-16881.patch
History View file @ 8b55502
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,148 @@
0 
+From 0381a0de64a5a048c3d48b79055bd9848d0c7fc2 Mon Sep 17 00:00:00 2001
1 
+From: PascalWithopf <pwithopf@adiscon.com>
2 
+Date: Wed, 19 Apr 2017 13:06:30 +0200
3 
+Subject: [PATCH] imptcp: fix Segmentation Fault when octet count is to high
4 
+
5 
+---
6 
+ plugins/imptcp/imptcp.c                   | 14 ++++++-
7 
+ tests/imptcp-msg-truncation-on-number.sh  | 37 +++++++++++++++++++
8 
+ tests/imptcp-msg-truncation-on-number2.sh | 45 +++++++++++++++++++++++
9 
+ 3 files changed, 94 insertions(+), 2 deletions(-)
10 
+ create mode 100755 tests/imptcp-msg-truncation-on-number.sh
11 
+ create mode 100755 tests/imptcp-msg-truncation-on-number2.sh
12 
+
13 
+diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
14 
+index acf0dcd25..b9a4e2fdf 100644
15 
+--- a/plugins/imptcp/imptcp.c
16 
+@@ -902,7 +902,16 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis,
17 
+
18 
+ 	if(pThis->inputState == eInOctetCnt) {
19 
+ 		if(isdigit(c)) {
20 
+-			pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
21 
++			if(pThis->iOctetsRemain <= 200000000) {
22 
++				pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
23 
++			} else {
24 
++				errmsg.LogError(0, NO_ERRCODE, "Framing Error in received TCP message: "
25 
++						"frame too large (at least %d%c), change to octet stuffing",
26 
++						pThis->iOctetsRemain, c);
27 
++				pThis->eFraming = TCP_FRAMING_OCTET_STUFFING;
28 
++				pThis->inputState = eInMsg;
29 
++			}
30 
++			*(pThis->pMsg + pThis->iMsg++) = c;
31 
+ 		} else { /* done with the octet count, so this must be the SP terminator */
32 
+ 			DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
33 
+ 			if(c != ' ') {
34 
+@@ -911,9 +920,9 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis,
35 
+ 			}
36 
+ 			if(pThis->iOctetsRemain < 1) {
37 
+ 				/* TODO: handle the case where the octet count is 0! */
38 
+-				DBGPRINTF("Framing Error: invalid octet count\n");
39 
+ 				errmsg.LogError(0, NO_ERRCODE, "Framing Error in received TCP message: "
40 
+ 					    "invalid octet count %d.", pThis->iOctetsRemain);
41 
++				pThis->eFraming = TCP_FRAMING_OCTET_STUFFING;
42 
+ 			} else if(pThis->iOctetsRemain > iMaxLine) {
43 
+ 				/* while we can not do anything against it, we can at least log an indication
44 
+ 				 * that something went wrong) -- rgerhards, 2008-03-14
45 
+@@ -924,6 +933,7 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis,
46 
+ 					        "max msg size is %d, truncating...", pThis->iOctetsRemain, iMaxLine);
47 
+ 			}
48 
+ 			pThis->inputState = eInMsg;
49 
++			pThis->iMsg = 0;
50 
+ 		}
51 
+ 	} else {
52 
+ 		assert(pThis->inputState == eInMsg);
53 
+diff --git a/tests/imptcp-msg-truncation-on-number.sh b/tests/imptcp-msg-truncation-on-number.sh
54 
+new file mode 100755
55 
+index 000000000..e46486bdf
56 
+--- /dev/null
57 
+@@ -0,0 +1,37 @@
58 
++#!/bin/bash
59 
++# addd 2017-03-01 by RGerhards, released under ASL 2.0
60 
++
61 
++. $srcdir/diag.sh init
62 
++. $srcdir/diag.sh generate-conf
63 
++. $srcdir/diag.sh add-conf '
64 
++$MaxMessageSize 128
65 
++global(processInternalMessages="on")
66 
++module(load="../plugins/imptcp/.libs/imptcp")
67 
++input(type="imptcp" port="13514")
68 
++
69 
++action(type="omfile" file="rsyslog.out.log")
70 
++
71 
++'
72 
++. $srcdir/diag.sh startup
73 
++. $srcdir/diag.sh tcpflood -m1 -M "\"<120> 2011-03-01T11:22:12Z host tag: this is a way too long message that has to be truncatedtest1 test2 test3 test4 test5 ab
74 
++9876543210 cdefghijklmn test8 test9 test10 test11 test12 test13 test14 test15 kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk tag: testtestetstetstetstetstetsstetstetsytetestetste\""
75 
++. $srcdir/diag.sh shutdown-when-empty
76 
++. $srcdir/diag.sh wait-shutdown
77 
++
78 
++grep "Framing Error.*change to octet stuffing" rsyslog.out.log > /dev/null
79 
++if [ $? -ne 0 ]; then
80 
++        echo
81 
++        echo "FAIL: expected error message from imptcp truncation not found. rsyslog.out.log is:"
82 
++        cat rsyslog.out.log
83 
++        . $srcdir/diag.sh error-exit 1
84 
++fi
85 
++
86 
++grep " 9876543210 cdefghijklmn test8 test9 test10 test11 test12 test13 test14 test15 kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk tag: testtestets" rsyslog.out.log > /dev/null
87 
++if [ $? -ne 0 ]; then
88 
++        echo
89 
++        echo "FAIL: expected error message from imptcp truncation not found. rsyslog.out.log is:"
90 
++        cat rsyslog.out.log
91 
++        . $srcdir/diag.sh error-exit 1
92 
++fi
93 
++
94 
++. $srcdir/diag.sh exit
95 
+diff --git a/tests/imptcp-msg-truncation-on-number2.sh b/tests/imptcp-msg-truncation-on-number2.sh
96 
+new file mode 100755
97 
+index 000000000..15c5aab15
98 
+--- /dev/null
99 
+@@ -0,0 +1,45 @@
100 
++#!/bin/bash
101 
++# addd 2017-03-01 by RGerhards, released under ASL 2.0
102 
++
103 
++. $srcdir/diag.sh init
104 
++. $srcdir/diag.sh generate-conf
105 
++. $srcdir/diag.sh add-conf '
106 
++$MaxMessageSize 128
107 
++global(processInternalMessages="on")
108 
++module(load="../plugins/imptcp/.libs/imptcp")
109 
++input(type="imptcp" port="13514" ruleset="ruleset1")
110 
++
111 
++template(name="templ1" type="string" string="%rawmsg%\n")
112 
++ruleset(name="ruleset1") {
113 
++	action(type="omfile" file="rsyslog.out.log" template="templ1")
114 
++}
115 
++
116 
++'
117 
++. $srcdir/diag.sh startup
118 
++. $srcdir/diag.sh tcpflood -m2 -M "\"41 <120> 2011-03-01T11:22:12Z host msgnum:1\""
119 
++. $srcdir/diag.sh tcpflood -m1 -M "\"214000000000 <120> 2011-03-01T11:22:12Z host msgnum:1\""
120 
++. $srcdir/diag.sh tcpflood -m1 -M "\"41 <120> 2011-03-01T11:22:12Z host msgnum:1\""
121 
++. $srcdir/diag.sh tcpflood -m1 -M "\"214000000000 <120> 2011-03-01T11:22:12Z host msgnum:1\""
122 
++. $srcdir/diag.sh tcpflood -m1 -M "\"41 <120> 2011-03-01T11:22:12Z host msgnum:1\""
123 
++. $srcdir/diag.sh tcpflood -m1 -M "\"2000000010 <120> 2011-03-01T11:22:12Z host msgnum:1\""
124 
++. $srcdir/diag.sh tcpflood -m1 -M "\"4000000000 <120> 2011-03-01T11:22:12Z host msgnum:1\""
125 
++. $srcdir/diag.sh tcpflood -m1 -M "\"0 <120> 2011-03-01T11:22:12Z host msgnum:1\""
126 
++. $srcdir/diag.sh shutdown-when-empty
127 
++. $srcdir/diag.sh wait-shutdown
128 
++
129 
++echo '<120> 2011-03-01T11:22:12Z host msgnum:1
130 
++<120> 2011-03-01T11:22:12Z host msgnum:1
131 
++214000000000 <120> 2011-03-01T11:22:12Z host msgnum:1
132 
++<120> 2011-03-01T11:22:12Z host msgnum:1
133 
++214000000000 <120> 2011-03-01T11:22:12Z host msgnum:1
134 
++<120> 2011-03-01T11:22:12Z host msgnum:1
135 
++2000000010 <120> 2011-03-01T11:22:12Z host msgnum:1
136 
++4000000000 <120> 2011-03-01T11:22:12Z host msgnum:1
137 
++<120> 2011-03-01T11:22:12Z host msgnum:1' | cmp rsyslog.out.log
138 
++if [ ! $? -eq 0 ]; then
139 
++  echo "invalid response generated, rsyslog.out.log is:"
140 
++  cat rsyslog.out.log
141 
++  . $srcdir/diag.sh error-exit  1
142 
++fi;
143 
++
144 
++. $srcdir/diag.sh exit
SPECS/rsyslog/rsyslog.spec
History View file @ 8b55502
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        Rocket-fast system for log processing
2 2 
 Name:           rsyslog
3 3 
 Version:        8.26.0
4 
-Release:        6%{?dist}
4 
+Release:        7%{?dist}
5 5 
 License:        GPLv3+ and ASL 2.0
6 6 
 URL:            http://www.rsyslog.com/
7 7 
 Source0:        http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
... ... 
@@ -11,6 +11,7 @@ Source2:        50-rsyslog-journald.conf
11 11 
 Source3:        rsyslog.conf
12 12 
 #Patch taken from https://github.com/rsyslog/rsyslog/pull/1565
13 13 
 Patch0:         CVE-2017-12588.patch
14 
+Patch1:         CVE-2018-16881.patch
14 15 
 Group:          System Environment/Base
15 16 
 Vendor:         VMware, Inc.
16 17 
 Distribution:   Photon
... ... 
@@ -35,6 +36,7 @@ It offers high-performance, great security features and a modular design. While
35 35 
 %prep
36 36 
 %setup -q
37 37 
 %patch0 -p1
38 
+%patch1 -p1
38 39 
 %build
39 40 
 sed -i 's/libsystemd-journal/libsystemd/' configure
40 41 
 ./configure \
... ... 
@@ -83,6 +85,8 @@ make %{?_smp_mflags} check
83 83 
 %{_sysconfdir}/rsyslog.conf
84 84 
 %{_sysconfdir}/rsyslog.d
85 85 
 %changelog
86 
+*   Thu Feb 14 2019 Keerthana K <keerthanak@vmware.com> 8.26.0-7
87 
+-   Fix for CVE-2018-16881.
86 88 
 *   Tue Apr 24 2018 Xiaolin Li <xiaolinl@vmware.com> 8.26.0-6
87 89 
 -   Include /etc/rsyslog.d/ in rpm.
88 90 
 *   Thu Apr 12 2018 Xiaolin Li <xiaolinl@vmware.com> 8.26.0-5