rpms/net-snmp
8
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-137501 - fix out of bound access

Browse Source 
Signed-off-by: Josef Ridky <jridky@redhat.com>
This commit is contained in:
Josef Ridky 2026-01-14 14:08:42 +01:00
parent 6640f63059
commit 3d35f7bf2b
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
net-snmp-5.9.4-oob-access.patch Normal file
View File

@ -0,0 +1,54 @@
From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 2 Nov 2025 14:48:55 -0800
Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses
Fixes: https://issues.oss-fuzz.com/issues/457106694
Fixes: https://issues.oss-fuzz.com/issues/458668421
Fixes: https://issues.oss-fuzz.com/issues/458876071
---
apps/snmptrapd_handlers.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 6cd126f266..afd93ed0fb 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session,
*/
if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
trapOidLen = pdu->enterprise_length;
+ /*
+ * Drop packets that would trigger an out-of-bounds trapOid[]
+ * access.
+ */
+ if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2)
+ return 1;
memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);
if (trapOid[trapOidLen - 1] != 0) {
trapOid[trapOidLen++] = 0;
From 35d216b57ea2e9abf1cc42077bcf60a4bae0b29e Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sat, 1 Nov 2025 13:47:37 -0700
Subject: [PATCH] snmptrapd: Do not write outside the bounds of trapOid[]
---
apps/snmptrapd_handlers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 0b8038f5d1..6cd126f266 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1155,8 +1155,8 @@ snmp_input(int op, netsnmp_session *session,
return 1; /* ??? */
}
}
- memcpy(trapOid, vars->val.objid, vars->val_len);
- trapOidLen = vars->val_len /sizeof(oid);
+ trapOidLen = SNMP_MIN(sizeof(trapOid), vars->val_len) / sizeof(oid);
+ memcpy(trapOid, vars->val.objid, trapOidLen * sizeof(oid));
break;
default:

7
net-snmp.spec
View File

@ -10,7 +10,7 @@
Summary: A collection of SNMP protocol tools and libraries
Name: net-snmp
Version: 5.8
Release: 32%{?dist}
Release: 33%{?dist}
Epoch: 1
License: BSD
@ -83,6 +83,7 @@ Patch54: net-snmp-5.8-truncating-log-once.patch
Patch55: net-snmp-5.8-CVE-2022-24805-24810.patch
Patch56: net-snmp-5.8-callback-fix.patch
Patch57: net-snmp-5.8-engine-evaluation.patch
Patch58: net-snmp-5.9.4-oob-access.patch
# Modern RPM API means at least EL6
Patch101: net-snmp-5.8-modern-rpm-api.patch
@ -265,6 +266,7 @@ rm -r python
%patch55 -p1 -b .CVE-2022-24805-24810
%patch56 -p1 -b .callback-fix
%patch57 -p1 -b .engine-evaluation
%patch58 -p1 -b .oob-access
%patch101 -p1 -b .modern-rpm-api
@ -519,6 +521,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
%{_libdir}/libnetsnmptrapd*.so.%{soname}*
%changelog
* Wed Jan 14 2026 Josef Ridky <jridky@redhat.com> - 1:5.8-33
- fix out of bound access (RHEL-137501)
* Wed Oct 29 2025 Josef Ridky <jridky@redhat.com> - 1:5.8-32
- fix engine order of evaluation (RHEL-116089)