rpms/net-snmp
8
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-137511 - fix out of bound access

Browse Source 
Signed-off-by: Josef Ridky <jridky@redhat.com>
This commit is contained in:
Josef Ridky 2026-01-13 17:13:56 +01:00
parent 600bc6d67d
commit 48aa7368ff
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
net-snmp-5.9.4-oob-access.patch Normal file
View File

@ -0,0 +1,54 @@
From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 2 Nov 2025 14:48:55 -0800
Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses
Fixes: https://issues.oss-fuzz.com/issues/457106694
Fixes: https://issues.oss-fuzz.com/issues/458668421
Fixes: https://issues.oss-fuzz.com/issues/458876071
---
apps/snmptrapd_handlers.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 6cd126f266..afd93ed0fb 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session,
*/
if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
trapOidLen = pdu->enterprise_length;
+ /*
+ * Drop packets that would trigger an out-of-bounds trapOid[]
+ * access.
+ */
+ if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2)
+ return 1;
memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);
if (trapOid[trapOidLen - 1] != 0) {
trapOid[trapOidLen++] = 0;
From 35d216b57ea2e9abf1cc42077bcf60a4bae0b29e Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sat, 1 Nov 2025 13:47:37 -0700
Subject: [PATCH] snmptrapd: Do not write outside the bounds of trapOid[]
---
apps/snmptrapd_handlers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 0b8038f5d1..6cd126f266 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1155,8 +1155,8 @@ snmp_input(int op, netsnmp_session *session,
return 1; /* ??? */
}
}
- memcpy(trapOid, vars->val.objid, vars->val_len);
- trapOidLen = vars->val_len /sizeof(oid);
+ trapOidLen = SNMP_MIN(sizeof(trapOid), vars->val_len) / sizeof(oid);
+ memcpy(trapOid, vars->val.objid, trapOidLen * sizeof(oid));
break;
default:

7
net-snmp.spec
View File

@ -10,7 +10,7 @@
Summary: A collection of SNMP protocol tools and libraries
Name: net-snmp
Version: 5.9.1
Release: 19%{?dist}
Release: 20%{?dist}
Epoch: 1
License: BSD
@ -64,6 +64,7 @@ Patch34: net-snmp-5.9.4-revert-n-snmptrapd-log.patch
Patch35: net-snmp-5.8-callback-fix.patch
Patch36: net-snmp-5.9.1-create-user-usage.patch
Patch37: net-snmp-5.9-remove-assert.patch
Patch38: net-snmp-5.9.4-oob-access.patch
# Modern RPM API means at least EL6
Patch101: net-snmp-5.8-modern-rpm-api.patch
@ -253,6 +254,7 @@ cp %{SOURCE10} .
%patch35 -p1 -b .callback-fix
%patch36 -p1 -b .create-user-usage
%patch37 -p1 -b .remove-assert
%patch38 -p1 -b .oob-access
%patch101 -p1 -b .modern-rpm-api
%patch102 -p1
@ -522,6 +524,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
%{_libdir}/libnetsnmptrapd*.so.%{soname}*
%changelog
* Tue Jan 13 2026 Josef Ridky <jridky@redhat.com> - 1:5.9.1-20
- fix out of bound access issue (RHEL-137511)
* Tue Nov 04 2025 Josef Ridky <jridky@redhat.com> - 1:5.9.1-19
- remove wrong assert (RHEL-122095)