BSD libc contains a buffer overflow vulnerability

Re:BSD libc contains a buffer overflow vulnerability by topspin on Wednesday December 07, 2016 @04:33PM (#13126422)

The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes.

It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes.

[1] https://news.ycombinator.com/item?id=8554003

[ Parent | on HN ]

Re:BSD libc contains a buffer overflow vulnerability by ben_bai on Wednesday December 07, 2016 @05:08PM (#13126719)

4.3BSD-Reno, basically unchanged since 1990 until yesterday.

http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src...

Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.

[ Parent | on HN ]

Re:BSD libc contains a buffer overflow vulnerability by tedunangst on Wednesday December 07, 2016 @05:47PM (#13126970)

That's not on the stack.

[ Parent | on HN ]

Re:BSD libc contains a buffer overflow vulnerability by ben_bai on Thursday December 08, 2016 @03:19AM (#13129092)

Oh indeed. Static it is...

[ Parent | on HN ]

Re:BSD libc contains a buffer overflow vulnerability by kps on Wednesday December 07, 2016 @04:49PM (#13126564)

4.3 Reno, apparently added as part of OSI networking, which explains why no one has ever heard of it.

(Pretty sure 4.3BSD didn't have loadable kernel modules; you built your kernel from source, uphill both ways in the snow.)

[ Parent | on HN ]