sudosrv_cmd - null pointer dereference

[ross-bradley]

Impact

Unprivileged users can crash the sssd_sudo process by sending a request before issuing the expected "hello" message. This results in a null pointer dereference.

Information

Whilst investigating some behaviour of the sssd suite, I accidentally seg faulted the sssd_sudo process. I hadn't read the protocol specs sufficiently well, and had sent a SSS_SUDO_GET_SUDORULES message immediately after connecting to the daemon. Debugging the seg fault showed this was the result of a null pointer dereference when retrieving the protocol version from the connection context. As the context had not been created due to the out-of-order message, a null pointer is dereferenced. This leads to a process crash.

This issue is abusable by unprivileged users as the permissions check that requires the caller to be privileged happens immediately after the null pointer dereference.

The process is started again very quickly, which mitigates the overall impact of unprivileged, local users being able to crash the process.

Recommendations

Perform null checks on the cli_protocol context object prior to dereferencing it.

In the event the check does not succeed, log the error and return an error code, as with the other checks in the function.

Affected location

File: https://github.com/SSSD/sssd/blob/master/src/responder/sudo/sudosrv_cmd.c
Method: sudosrv_cmd
Line number: 203

static int sudosrv_cmd(enum sss_sudo_type type, struct cli_ctx *cli_ctx)
{
...
    cmd_ctx->cli_ctx = cli_ctx;
    cmd_ctx->type = type;
    cmd_ctx->sudo_ctx = talloc_get_type(cli_ctx->rctx->pvt_ctx, struct sudo_ctx);
    if (cmd_ctx->sudo_ctx == NULL) {
        DEBUG(SSSDBG_FATAL_FAILURE, "sudo_ctx not set, killing connection!\n");
        return EFAULT;
    }

    pctx = talloc_get_type(cli_ctx->protocol_ctx, struct cli_protocol);
    protocol = pctx->cli_protocol_version->version; // RB: NULL POINTER DEREF OCCURS HERE

    /* the only intended client - suid binary 'sudo' */
    if (cli_ctx->priv != 1) {
      ...

Screenshot