Bugzilla – Bug 980854
VUL-0: CVE-2016-4429: glibc: A stack frame overflow flaw was found in the glibc's clntudp_call
Last modified: 2020-06-11 20:30:50 UTC
CVE-2016-4429 Florian Weimer 2016-05-18 11:58:40 UTC clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Florian Weimer 2016-05-18 12:01:14 UTC This was discovered by Aldy Hernandez' alloca plugin for GCC. Introduced in this commit: commit b1eab230118c7d65223927486afb7fe0b531bf33 Author: Ulrich Drepper <drepper@redhat.com> Date: Wed Jan 10 23:47:39 2001 +0000 … 2001-01-10 Jakub Jelinek <jakub@redhat.com> * sunrpc/clnt_udp.c (clntudp_bufcreate): Set IP_RECVERR on the UDP socket. (clntudp_call): Handle MSG_ERRQUEUE. * sysdeps/generic/errqueue.h: New file. * sysdeps/unix/sysv/linux/errqueue.h: New file. I have a patch (replace the alloca with malloc/free). libtirpc is affected as well. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4429 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4429.html
bugbot adjusting priority
Created attachment 678123 [details] Fix for CVE-2016-4429. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1337136#c5
This is an autogenerated message for OBS integration: This bug (980854) was mentioned in https://build.opensuse.org/request/show/398848 13.2 / glibc
This is an autogenerated message for OBS integration: This bug (980854) was mentioned in https://build.opensuse.org/request/show/398988 Factory / glibc
openSUSE-SU-2016:1527-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 969727,973010,973164,980483,980854 CVE References: CVE-2016-1234,CVE-2016-3075,CVE-2016-3706,CVE-2016-4429 Sources used: openSUSE 13.2 (src): glibc-2.19-16.25.1, glibc-2.19-16.25.2, glibc-testsuite-2.19-16.25.2, glibc-utils-2.19-16.25.1
SUSE-SU-2016:1721-1: An update that solves four vulnerabilities and has three fixes is now available. Category: security (moderate) Bug References: 968787,969727,973010,973164,975930,980483,980854 CVE References: CVE-2016-1234,CVE-2016-3075,CVE-2016-3706,CVE-2016-4429 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): glibc-2.19-22.16.2 SUSE Linux Enterprise Server 12 (src): glibc-2.19-22.16.2 SUSE Linux Enterprise Desktop 12 (src): glibc-2.19-22.16.2
SUSE-SU-2016:1733-1: An update that solves four vulnerabilities and has four fixes is now available. Category: security (moderate) Bug References: 967190,968787,969727,973010,973164,975930,980483,980854 CVE References: CVE-2016-1234,CVE-2016-3075,CVE-2016-3706,CVE-2016-4429 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP1 (src): glibc-2.19-38.2 SUSE Linux Enterprise Server 12-SP1 (src): glibc-2.19-38.2 SUSE Linux Enterprise Desktop 12-SP1 (src): glibc-2.19-38.2
openSUSE-SU-2016:1779-1: An update that solves four vulnerabilities and has four fixes is now available. Category: security (moderate) Bug References: 967190,968787,969727,973010,973164,975930,980483,980854 CVE References: CVE-2016-1234,CVE-2016-3075,CVE-2016-3706,CVE-2016-4429 Sources used: openSUSE Leap 42.1 (src): glibc-2.19-22.1, glibc-testsuite-2.19-22.2, glibc-utils-2.19-22.1
SUSE-SU-2016:2156-1: An update that solves four vulnerabilities and has 5 fixes is now available. Category: security (moderate) Bug References: 931399,965699,969727,973010,973164,973179,980483,980854,986302 CVE References: CVE-2016-1234,CVE-2016-3075,CVE-2016-3706,CVE-2016-4429 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): glibc-2.11.3-17.102.1 SUSE Linux Enterprise Server 11-SP4 (src): glibc-2.11.3-17.102.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): glibc-2.11.3-17.102.1