Import from CS git
This commit is contained in:
parent
99fbe3719d
commit
539333a04f
@ -0,0 +1,52 @@
|
||||
From bf40cc27c4ce8451d4b062c9de0b67ec40894812 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Dunlap <cdunlap@llnl.gov>
|
||||
Date: Mon, 26 Jan 2026 20:42:40 -0800
|
||||
Subject: [PATCH] Fix buffer overflow when unpacking message address length
|
||||
|
||||
Add validation that addr_len does not exceed the size of the addr
|
||||
field before copying IP address data in _msg_unpack().
|
||||
|
||||
The m_msg structure contains a 4-byte struct in_addr for the IP
|
||||
address. When unpacking a MUNGE_MSG_DEC_RSP message, the addr_len
|
||||
field (uint8_t) was read from untrusted message data and used directly
|
||||
in _copy() without validation. An attacker setting addr_len to 255
|
||||
causes _copy() to write 251 bytes past the end of the addr field,
|
||||
corrupting subsequent structure members.
|
||||
|
||||
This buffer overflow corrupts munged's internal state and can
|
||||
be exploited by a local attacker to leak conf->mac_key and other
|
||||
cryptographic secrets from process memory. With the leaked key,
|
||||
an attacker can forge arbitrary MUNGE credentials to impersonate any
|
||||
user to services that rely on MUNGE for authentication.
|
||||
|
||||
Any local user can trigger this by connecting to munged's Unix socket
|
||||
and sending a crafted MUNGE_MSG_DEC_RSP message. While message type
|
||||
validation in job_exec() will reject response-type messages, this
|
||||
validation occurs after m_msg_recv() has already called _msg_unpack()
|
||||
to process the message body. The buffer overflow occurs during the
|
||||
unpacking phase, before the message type is validated and rejected.
|
||||
|
||||
A working proof-of-concept exploit exists that demonstrates key
|
||||
leakage and credential forgery.
|
||||
|
||||
Reported-by: Titouan Lazard <t.lazard@lexfo.fr>
|
||||
Security: CVE-2026-25506
|
||||
---
|
||||
src/libcommon/m_msg.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/src/libcommon/m_msg.c b/src/libcommon/m_msg.c
|
||||
index 38e01ae3dd81..eaeaf0b8bc3e 100644
|
||||
--- a/src/libcommon/m_msg.c
|
||||
+++ b/src/libcommon/m_msg.c
|
||||
@@ -686,6 +686,7 @@ _msg_unpack (m_msg_t m, m_msg_type_t type, const void *src, int srclen)
|
||||
else if ( _copy (m->realm_str, p, m->realm_len, p, q, &p) < 0) ;
|
||||
else if (!_unpack (&(m->ttl), &p, sizeof (m->ttl), q)) ;
|
||||
else if (!_unpack (&(m->addr_len), &p, sizeof (m->addr_len), q)) ;
|
||||
+ else if (m->addr_len > sizeof (m->addr)) goto err;
|
||||
else if ( _copy (&(m->addr), p, m->addr_len, p, q, &p) < 0) ;
|
||||
else if (!_unpack (&(m->time0), &p, sizeof (m->time0), q)) ;
|
||||
else if (!_unpack (&(m->time1), &p, sizeof (m->time1), q)) ;
|
||||
--
|
||||
2.52.0
|
||||
|
||||
@ -1,19 +1,21 @@
|
||||
Name: munge
|
||||
Version: 0.5.13
|
||||
Release: 1%{?dist}
|
||||
Release: 3%{?dist}
|
||||
Summary: Enables uid & gid authentication across a host cluster
|
||||
|
||||
Group: Applications/System
|
||||
# The libs and devel package is GPLv3+ and LGPLv3+ where as the main package is GPLv3 only.
|
||||
License: GPLv3+ and LGPLv3+
|
||||
URL: https://dun.github.io/munge/
|
||||
Source0: https://github.com/dun/munge/releases/download/munge-%{version}/munge-%{version}.tar.xz
|
||||
Source1: create-munge-key
|
||||
Source2: munge.logrotate
|
||||
Patch01: Fix-buffer-overflow-when-unpacking-message-address-l.patch
|
||||
|
||||
BuildRequires: systemd-units
|
||||
BuildRequires: zlib-devel bzip2-devel libgcrypt-devel
|
||||
BuildRequires: gcc
|
||||
BuildRequires: systemd-rpm-macros
|
||||
BuildRequires: zlib-devel bzip2-devel openssl-devel
|
||||
Requires: munge-libs = %{version}-%{release}
|
||||
Requires: logrotate
|
||||
|
||||
Requires(pre): shadow-utils
|
||||
|
||||
@ -21,7 +23,6 @@ Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
|
||||
%description
|
||||
MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating
|
||||
and validating credentials. It is designed to be highly scalable for use
|
||||
@ -35,7 +36,6 @@ methods.
|
||||
|
||||
%package devel
|
||||
Summary: Development files for uid * gid authentication across a host cluster
|
||||
Group: Applications/System
|
||||
Requires: munge-libs%{?_isa} = %{version}-%{release}
|
||||
|
||||
%description devel
|
||||
@ -43,7 +43,6 @@ Header files for developing using MUNGE.
|
||||
|
||||
%package libs
|
||||
Summary: Runtime libs for uid * gid authentication across a host cluster
|
||||
Group: Applications/System
|
||||
|
||||
%description libs
|
||||
Runtime libraries for using MUNGE.
|
||||
@ -51,11 +50,13 @@ Runtime libraries for using MUNGE.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch -P 1 -p1
|
||||
cp -p %{SOURCE1} create-munge-key
|
||||
cp -p %{SOURCE2} munge.logrotate
|
||||
|
||||
%build
|
||||
%configure --disable-static --with-crypto-lib=libgcrypt
|
||||
%configure --disable-static --with-crypto-lib=openssl
|
||||
echo "d /run/munge 0755 munge munge -" > src/etc/munge.tmpfiles.conf.in
|
||||
# Get rid of some rpaths for /usr/sbin
|
||||
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
|
||||
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
|
||||
@ -63,9 +64,7 @@ make %{?_smp_mflags}
|
||||
|
||||
|
||||
%install
|
||||
|
||||
rm -rf %{buildroot}
|
||||
make install DESTDIR=%{buildroot}
|
||||
%make_install
|
||||
|
||||
# Install extra files.
|
||||
install -p -m 755 create-munge-key %{buildroot}/%{_sbindir}/create-munge-key
|
||||
@ -88,12 +87,7 @@ chmod 700 %{buildroot}%{_sysconfdir}/munge
|
||||
# i.e it is not actually included in the rpm, only the record
|
||||
# of it is.
|
||||
touch %{buildroot}%{_var}/run/munge/munged.pid
|
||||
|
||||
%clean
|
||||
rm -rf %{buildroot}
|
||||
|
||||
%postun
|
||||
%systemd_postun_with_restart munge.service
|
||||
mv %{buildroot}%{_var}/run %{buildroot}
|
||||
|
||||
%preun
|
||||
%systemd_preun munge.service
|
||||
@ -109,8 +103,10 @@ exit 0
|
||||
%post
|
||||
%systemd_post munge.service
|
||||
|
||||
%post libs -p /sbin/ldconfig
|
||||
%postun libs -p /sbin/ldconfig
|
||||
%postun
|
||||
%systemd_postun_with_restart munge.service
|
||||
|
||||
%ldconfig_scriptlets libs
|
||||
|
||||
%files
|
||||
%{_bindir}/munge
|
||||
@ -126,14 +122,15 @@ exit 0
|
||||
%{_unitdir}/munge.service
|
||||
|
||||
%attr(0700,munge,munge) %dir %{_var}/log/munge
|
||||
%attr(0700,munge,munge) %dir %{_sysconfdir}/munge
|
||||
%attr(0755,munge,munge) %dir %{_var}/run/munge/
|
||||
%attr(0644,munge,munge) %ghost %{_var}/run/munge/munged.pid
|
||||
%attr(0700,munge,munge) %dir %{_var}/lib/munge
|
||||
%attr(0700,munge,munge) %dir %{_sysconfdir}/munge
|
||||
%attr(0755,munge,munge) %dir /run/munge/
|
||||
%attr(0644,munge,munge) %ghost /run/munge/munged.pid
|
||||
|
||||
%config(noreplace) %{_tmpfilesdir}/munge.conf
|
||||
%config(noreplace) %{_sysconfdir}/logrotate.d/munge
|
||||
|
||||
%license COPYING COPYING.LESSER
|
||||
%doc AUTHORS
|
||||
%doc JARGON META NEWS QUICKSTART README
|
||||
%doc doc
|
||||
@ -141,7 +138,6 @@ exit 0
|
||||
%files libs
|
||||
%{_libdir}/libmunge.so.2
|
||||
%{_libdir}/libmunge.so.2.0.0
|
||||
%doc COPYING COPYING.LESSER
|
||||
|
||||
%files devel
|
||||
%{_includedir}/munge.h
|
||||
@ -165,6 +161,14 @@ exit 0
|
||||
|
||||
|
||||
%changelog
|
||||
* Sun Feb 15 2026 Kamal Heib <kheib@redhat.com> - 0.5.13-3
|
||||
- Fix CVE-2026-25506
|
||||
- Resolves: RHEL-148521
|
||||
|
||||
* Fri Apr 24 2020 Honggang Li <honli@redhat.com> - 0.5.13-2
|
||||
- Don't create temporary files in legacy directory
|
||||
- Resolves: bz1805956
|
||||
|
||||
* Thu Jul 19 2018 Jarod Wilson <jarod@redhat.com> - 0.5.13-1
|
||||
- Update to upstream 0.5.13 release
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user