InfoSect's Month of Pointless Bugs (#26)
InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.
Bug #26
In bsdgames/sail
int
lo_main(void)
{
FILE *fp;
char sbuf[32];
Bug #26
In bsdgames/sail
int
lo_main(void)
{
FILE *fp;
char sbuf[32];
...
while (fread((char *)&log, sizeof log, 1, fp) == 1 &&
log.l_name[0] != '\0') {
if (longfmt && (pass = getpwuid(log.l_uid)) != NULL)
sprintf(sbuf, "%10.10s (%s)", log.l_name, pass->pw_name);
else
sprintf(sbuf, "%20.20s", log.l_name);
Lets look at what the max username length is on my specific system:
$ getconf LOGIN_NAME_MAX
256
Now if we combine this with the fact the calls to setegid() don't check the return value and may fail (see http://blog.infosectcbr.com.au/2018/02/infosects-month-of-pointless-bugs-3.html) we may have a bug chain leading to a stack overflow at the privilege of gid games.