[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <D6O1R3A84O01.2ATH141FJN2K9@runxiyu.org>
Date: Sun, 29 Dec 2024 16:38:03 +0800
From: "Runxi Yu" <runxiyuld@...xiyu.org>
To: <musl@...ts.openwall.com>
Subject: crypt(3) returns "*" from read-only region, segfaulting passwd(1)
on Alpine for long passwords
Hi,
Test_User <hax@...xiyu.org> discovered that using passwd(1) from
shadow-utils on Alpine Linux 3.21 with a password longer than 256
character causes a segmentation fault. I reported it to
<https://gitlab.alpinelinux.org/alpine/aports/-/issues/16784>, and
people in #alpine-linux helped a bit.
It turns out that musl's crypt(3) returns a "*" from a string literal,
which PAM attempts to erase with pam_overwrite_string.
(Irrelevant lines truncated)
musl/src/crypt/crypt_sha512.c
> if (!p || q != testbuf || memcmp(testbuf, testhash, sizeof testhash))
> return "*";
pam/modules/pass_unix/passverify.c
> sp = crypt(password, salt);
> if (!sp || strncmp(algoid, sp, strlen(algoid)) != 0) {
> pam_syslog(...);
> if(sp) {
> pam_overwrite_string(sp); /* <-- attempt to overwrite musl's string literal */
> }
> return NULL;
> }
https://pubs.opengroup.org/onlinepubs/9799919799/functions/crypt.html:
> The return value of crypt() points to static data that is overwritten
> by each call.
>
> Upon successful completion, crypt() shall return a pointer to the
> hashed password; the first two bytes of the returned value shall be
> those of the salt argument. Otherwise, it shall return a null pointer
> and set errno to indicate the error.
I think musl's behavior of returning "*" is incorrect. It's rather
reasonable for the caller to attempt to erase whatever is returned by
crypt, and AFAIK there is no specification that allows returning "*" as
a failure return value.
Note: I am not on the mailing list; please CC me in replies.
--
Best regards,
Runxi Yu (they/them)
Year 11, E House
YK Pao School SJ
https://runxiyu.org
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
