rpms/net-snmp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI net-snmp-5.9.4-15.el10_1.2

Browse Source
This commit is contained in:
eabdullin 2026-01-15 14:33:18 +00:00
parent 0c9459614b
commit b172dcd045
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
net-snmp-5.9.4-oob-access.patch Normal file
View File

@ -0,0 +1,54 @@
From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 2 Nov 2025 14:48:55 -0800
Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses
Fixes: https://issues.oss-fuzz.com/issues/457106694
Fixes: https://issues.oss-fuzz.com/issues/458668421
Fixes: https://issues.oss-fuzz.com/issues/458876071
---
apps/snmptrapd_handlers.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 6cd126f266..afd93ed0fb 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session,
*/
if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
trapOidLen = pdu->enterprise_length;
+ /*
+ * Drop packets that would trigger an out-of-bounds trapOid[]
+ * access.
+ */
+ if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2)
+ return 1;
memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);
if (trapOid[trapOidLen - 1] != 0) {
trapOid[trapOidLen++] = 0;
From 35d216b57ea2e9abf1cc42077bcf60a4bae0b29e Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sat, 1 Nov 2025 13:47:37 -0700
Subject: [PATCH] snmptrapd: Do not write outside the bounds of trapOid[]
---
apps/snmptrapd_handlers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
index 0b8038f5d1..6cd126f266 100644
--- a/apps/snmptrapd_handlers.c
+++ b/apps/snmptrapd_handlers.c
@@ -1155,8 +1155,8 @@ snmp_input(int op, netsnmp_session *session,
return 1; /* ??? */
}
}
- memcpy(trapOid, vars->val.objid, vars->val_len);
- trapOidLen = vars->val_len /sizeof(oid);
+ trapOidLen = SNMP_MIN(sizeof(trapOid), vars->val_len) / sizeof(oid);
+ memcpy(trapOid, vars->val.objid, trapOidLen * sizeof(oid));
break;
default:

7
net-snmp.spec
View File

@ -10,7 +10,7 @@
Summary: A collection of SNMP protocol tools and libraries
Name: net-snmp
Version: 5.9.4
Release: 15%{?dist}.1
Release: 15%{?dist}.2
Epoch: 1
License: MIT-CMU and BSD-3-Clause and MIT and OpenSSL
@ -54,6 +54,7 @@ Patch24: net-snmp-5.9.4-test-fix.patch
Patch25: net-snmp-5.9.4-kernel-6.7.patch
Patch26: net-snmp-5.9.4-remove-mail-sender.patch
Patch27: net-snmp-5.9.4-tls.patch
Patch28: net-snmp-5.9.4-oob-access.patch
# Modern RPM API means at least EL6
Patch101: net-snmp-5.8-modern-rpm-api.patch
@ -247,6 +248,7 @@ cp %{SOURCE10} .
%patch 25 -p1 -b .kernel-fix
%patch 26 -p1 -b .remove-mail-sender
%patch 27 -p1 -b .tls
%patch 28 -p1 -b .oob-access
%patch 101 -p1 -b .modern-rpm-api
%patch 102 -p1
@ -517,6 +519,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
%{_libdir}/libnetsnmptrapd*.so.%{soname}*
%changelog
* Tue Jan 13 2026 Josef Ridky <jridky@redhat.com> - 1:5.9.4-15.2
- fix out of bound access (RHEL-137497)
* Mon Sep 08 2025 Josef Ridky <jridky@redhat.com> - 1:5.9.4-15.1
- enable PQC (RHEL-112338)