rpms/dhcp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix sll pointer leak for aliased InfiniBand interfaces in get_hw_addr2()

Browse Source 
Resolves: RHEL-235872
This commit is contained in:
Martin Osvald 2026-08-11 11:24:02 +02:00
parent c048c07f18
commit 3824751c6d
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dhcp.spec
View File

@ -15,7 +15,7 @@
Summary: Dynamic host configuration protocol software
Name: dhcp
Version: 4.4.2
Release: 21.b1%{?dist}
Release: 22.b1%{?dist}
# NEVER CHANGE THE EPOCH on this package. The previous maintainer (prior to
# dcantrell maintaining the package) made incorrect use of the epoch and
@ -70,6 +70,7 @@ Patch32: CVE-2022-2928.patch
Patch33: CVE-2022-2929.patch
Patch34: dont-drop-bounds-twice.patch
Patch35: fix-buffer-overflow-in-print_hw_addr.patch
Patch36: fix-sll-leak-aliased-ib-interface.patch
BuildRequires: autoconf
@ -513,6 +514,10 @@ done
%endif
%changelog
* Thu Aug 06 2026 Martin Osvald <mosvald@redhat.com> - 12:4.4.2-22.b1
- Fix sll pointer leak for aliased InfiniBand interfaces in get_hw_addr2()
Resolves: RHEL-235872
* Tue Mar 31 2026 Martin Osvald <mosvald@redhat.com> - 12:4.4.2-21.b1
- Fix buffer overflow in print_hw_addr()
Resolves: RHEL-151420

30
fix-sll-leak-aliased-ib-interface.patch Normal file
View File

@ -0,0 +1,30 @@
From: Martin Osvald <mosvald@redhat.com>
Date: Wed, 6 Aug 2026 10:00:00 +0200
Subject: [PATCH] Fix sll pointer leak for aliased InfiniBand interfaces
When get_ll() fails for an aliased IB interface (e.g. ib0:0) and
ioctl_get_ll() is used instead (sll_allocated=1), the ARPHRD_INFINIBAND
case strips the alias suffix and re-calls get_ll(), overwriting sll with
an ifaddrs-internal pointer while sll_allocated remains 1. The subsequent
dfree(sll, MDL) then frees a pointer not returned by dmalloc, causing
heap corruption and SIGABRT ("free(): invalid pointer").
Free the ioctl_get_ll() allocation before overwriting sll.
Signed-off-by: Martin Osvald <mosvald@redhat.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
diff --git a/common/lpf.c b/common/lpf.c
index 25f4c68..cbbdedc 100644
--- a/common/lpf.c
+++ b/common/lpf.c
@@ -784,6 +784,10 @@ get_hw_addr2(struct interface_info *info)
*/
if ((colon = strchr(dup, ':')) != NULL) {
*colon = '\0';
+ if (sll_allocated) {
+ dfree(sll, MDL);
+ sll_allocated = 0;
+ }
if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL)
log_fatal("Error getting hardware address for \"%s\": %m", name);
}