File sudo-CVE-2022-43995.patch of Package sudo

Overview Repositories Revisions Requests Users Attributes Meta

File sudo-CVE-2022-43995.patch of Package sudo (Revision 1e8b02a2a94037ea5ea557032c1cb466)

Currently displaying revision 1e8b02a2a94037ea5ea557032c1cb466 , Show latest

From bd209b9f16fcd1270c13db27ae3329c677d48050 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Fri, 28 Oct 2022 07:29:55 -0600
Subject: [PATCH] Fix CVE-2022-43995, potential heap overflow for passwords < 8
 characters. Starting with sudo 1.8.0 the plaintext password buffer is
 dynamically sized so it is not safe to assume that it is at least 9 bytes in
 size. Found by Hugo Lefeuvre (University of Manchester) with ConfFuzz.

---
 plugins/sudoers/auth/passwd.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c
index b2046eca2..0416861e9 100644
--- a/plugins/sudoers/auth/passwd.c
+++ b/plugins/sudoers/auth/passwd.c
@@ -63,7 +63,7 @@ sudo_passwd_init(struct passwd *pw, sudo_auth *auth)
 int
 sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback)
 {
-    char sav, *epass;
+    char des_pass[9], *epass;
     char *pw_epasswd = auth->data;
     size_t pw_len;
     int matched = 0;
@@ -75,12 +75,12 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
 
     /*
      * Truncate to 8 chars if standard DES since not all crypt()'s do this.
-     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
      */
-    sav = pass[8];
     pw_len = strlen(pw_epasswd);
-    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
-	pass[8] = '\0';
+    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
+	strlcpy(des_pass, pass, sizeof(des_pass));
+	pass = des_pass;
+    }
 
     /*
      * Normal UN*X password check.
@@ -88,7 +88,6 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
      * only compare the first DESLEN characters in that case.
      */
     epass = (char *) crypt(pass, pw_epasswd);
-    pass[8] = sav;
     if (epass != NULL) {
 	if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
 	    matched = !strncmp(pw_epasswd, epass, DESLEN);

Places

File sudo-CVE-2022-43995.patch of Package sudo (Revision 1e8b02a2a94037ea5ea557032c1cb466)

Places