The Samba-Bugzilla – Attachment 16075 Details for
Bug 14417
CVE-2020-14303 [SECURITY] Endless loop from empty UDP packet sent to AD DC nbt_server
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch for master V2
CVE-2020-14303-master.patch (text/plain), 1.55 KB, created by
Gary Lockyer
on 2020-06-24 22:31:35 UTC
(
hide
)
Description:
Patch for master V2
Filename:
MIME Type:
Creator:
Gary Lockyer
Created:
2020-06-24 22:31:35 UTC
Size:
1.55 KB
patch
obsolete
>From 2d48f44d3f611e7b5868dafbab33e2ab66cf791b Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Wed, 24 Jun 2020 14:27:08 +1200 >Subject: [PATCH] CVE-2020-14303: s4 nbt: fix busy loop on empty UDP packet > >An empty UDP packet put the nbt server into a busy loop that consumes >100% of a cpu. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14417 > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >--- > libcli/nbt/nbtsocket.c | 17 ++++++++++++++++- > 1 file changed, 16 insertions(+), 1 deletion(-) > >diff --git a/libcli/nbt/nbtsocket.c b/libcli/nbt/nbtsocket.c >index f682b233fd1..97b0ca34337 100644 >--- a/libcli/nbt/nbtsocket.c >+++ b/libcli/nbt/nbtsocket.c >@@ -167,8 +167,23 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock) > return; > } > >+ /* >+ * Given a zero length, data_blob_talloc() returns the >+ * NULL blob {NULL, 0}. >+ * >+ * We only want to error return here on a real out of memory condition >+ * (i.e. dsize != 0, so the UDP packet has data, but the return of the >+ * allocation failed, so blob.data==NULL). >+ * >+ * Given an actual zero length UDP packet having blob.data == NULL >+ * isn't an out of memory error condition, that's the defined semantics >+ * of data_blob_talloc() when asked for zero bytes. >+ * >+ * We still need to continue to do the zero-length socket_recvfrom() >+ * read in order to clear the "read pending" condition on the socket. >+ */ > blob = data_blob_talloc(tmp_ctx, NULL, dsize); >- if (blob.data == NULL) { >+ if (blob.data == NULL && dsize != 0) { > talloc_free(tmp_ctx); > return; > } >-- >2.17.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
abartlet
:
review+
gary
:
ci-passed+
Actions:
View
Attachments on
bug 14417
:
16070
|
16071
|
16072
|
16073
| 16075 |
16076
|
16077
|
16078
|
16079
|
16080
|
16081
|
16082
|
16083
|
16084
|
16085
|
16086
|
16087
|
16092