[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160818184456.GA16393@sinister.codevat.com>
Date: Thu, 18 Aug 2016 11:44:56 -0700
From: Eric Pruitt <eric.pruitt@...il.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: CVE request - slock, all versions NULL pointer dereference
The screen locking application slock (http://tools.suckless.org/slock/)
calls crypt(3) and uses the return value for strcmp(3) without checking
to see if the return value of crypt(3) was a NULL pointer. If the hash
returned by (getspnam()->sp_pwdp) is invalid, crypt(3) will return NULL
and set errno to EINVAL. This will cause slock to segfault which then
leaves the machine unprotected. A couple of common scenarios where this
might happen are:
- a machine using NSS for authentication; on the machine I discovered
this bug, (getspnam()->sp_pwdp) returns "*".
- the user's account has been disabled for one reason or another; maybe
account expiry or password expiry.
One approach to ensure slock will not run on machines without local
hashes would be to check the return value of crypt("x", (...)->sp_pwdp)
and verify that it returns a non NULL value before actually locking the
screen.
Eric
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
