diff options
| author | Florian Weimer <fweimer@redhat.com> | 2017-02-28 17:05:46 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2017-02-28 17:05:46 +0100 |
| commit | 045e368799cd253ddbf8bdec42ed92e8ebb3ce67 (patch) | |
| tree | f4ee4234ab3af53433819a290951901ecc30283d /NEWS | |
| parent | 58520986c38e34db60e07260c64c563e3efcf353 (diff) | |
| download | glibc-045e368799cd253ddbf8bdec42ed92e8ebb3ce67.tar.gz | |
sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]
After commit bc779a1a5b3035133024b21e2f339fe4219fb11c
(CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call
[BZ #20112]), ancillary data is stored on the heap,
but it is accessed after it has been freed.
The test case must be run under a heap debugger such as valgrind
to observe the invalid access. A malloc implementation which
immediately calls munmap on free would catch this bug as well.
(cherry picked from commit d42eed4a044e5e10dfb885cf9891c2518a72a491)
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 1 |
1 files changed, 1 insertions, 0 deletions
@@ -10,6 +10,7 @@ Version 2.25.1 The following bugs are resolved with this release: [21109] Tunables broken on big-endian + [21115] sunrpc: Use-after-free in error path in clntudp_call Version 2.25 |