Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Aug 2016 11:44:56 -0700
From: Eric Pruitt <eric.pruitt@...il.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: CVE request - slock, all versions NULL pointer dereference

The screen locking application slock (http://tools.suckless.org/slock/)
calls crypt(3) and uses the return value for strcmp(3) without checking
to see if the return value of crypt(3) was a NULL pointer. If the hash
returned by (getspnam()->sp_pwdp) is invalid, crypt(3) will return NULL
and set errno to EINVAL. This will cause slock to segfault which then
leaves the machine unprotected. A couple of common scenarios where this
might happen are:

- a machine using NSS for authentication; on the machine I discovered
  this bug, (getspnam()->sp_pwdp) returns "*".
- the user's account has been disabled for one reason or another; maybe
  account expiry or password expiry.

One approach to ensure slock will not run on machines without local
hashes would be to check the return value of crypt("x", (...)->sp_pwdp)
and verify that it returns a non NULL value before actually locking the
screen.

Eric

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.