Date: Thu, 18 Aug 2016 11:44:56 -0700 From: Eric Pruitt <eric.pruitt@...il.com> To: Open Source Security <oss-security@...ts.openwall.com> Subject: CVE request - slock, all versions NULL pointer dereference The screen locking application slock (http://tools.suckless.org/slock/) calls crypt(3) and uses the return value for strcmp(3) without checking to see if the return value of crypt(3) was a NULL pointer. If the hash returned by (getspnam()->sp_pwdp) is invalid, crypt(3) will return NULL and set errno to EINVAL. This will cause slock to segfault which then leaves the machine unprotected. A couple of common scenarios where this might happen are: - a machine using NSS for authentication; on the machine I discovered this bug, (getspnam()->sp_pwdp) returns "*". - the user's account has been disabled for one reason or another; maybe account expiry or password expiry. One approach to ensure slock will not run on machines without local hashes would be to check the return value of crypt("x", (...)->sp_pwdp) and verify that it returns a non NULL value before actually locking the screen. Eric
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.