September 2017 - tor-commits - lists.torproject.org

[tor/master] Fix log-uninitialized-stack bug in rend_service_intro_established.
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 09ea89764a4d3a907808ed7d4fe42abfe64bd486 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:25:21 2017 -0400 Fix log-uninitialized-stack bug in rend_service_intro_established. Fixes bug 23490; bugfix on 0.2.7.2-alpha. TROVE-2017-008 CVE-2017-0380 --- changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/changes/trove-2017-008 b/changes/trove-2017-008 new file mode 100644 index 000000000..4b9c5b0a1 --- /dev/null +++ b/changes/trove-2017-008 @@ -0,0 +1,5 @@ + o Major bugfixes (security, hidden services, loggging): + - Fix a bug where we could log uninitialized stack when a certain + hidden service error occurred while SafeLogging was disabled. + Fixes bug #23490; bugfix on 0.2.7.2-alpha. + This is also tracked as TROVE-2017-008 and CVE-2017-0380. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index fb777ca15..8087e8849 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -3372,6 +3372,8 @@ rend_service_intro_established(origin_circuit_t *circuit, (unsigned)circuit->base_.n_circ_id); goto err; } + base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1, + rend_pk_digest, REND_SERVICE_ID_LEN); /* We've just successfully established a intro circuit to one of our * introduction point, account for it. */ intro = find_intro_point(circuit); @@ -3388,8 +3390,6 @@ rend_service_intro_established(origin_circuit_t *circuit, service->desc_is_dirty = time(NULL); circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_INTRO); - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1, - rend_pk_digest, REND_SERVICE_ID_LEN); log_info(LD_REND, "Received INTRO_ESTABLISHED cell on circuit %u for service %s", (unsigned)circuit->base_.n_circ_id, serviceid);

1 0

[tor/master] Merge branch 'trove-2017-008_028' into maint-0.2.8
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 0ec72b030839c3a9e8c557483594b9dbe86c0792 Merge: 26f68dfce 4a2cbea6c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:39:35 2017 -0400 Merge branch 'trove-2017-008_028' into maint-0.2.8 changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 314652dc16ece380de343ccdc5a2155d612bcff7 Merge: f7b06202c 0ec72b030 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:39:46 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.8' into maint-0.3.0
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 7df790890593de1cc2aef84305102f80c00bb8f8 Merge: e46849846 0ec72b030 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:40:09 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.3.0 This is an "ours" merge to avoid the conflict from the 0.2.8 version of the fix for TROVE-2017-008.

1 0

[tor/master] Merge branch 'trove-2017-008_030' into maint-0.3.0
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 9d8d4cb3fa3e678955b30dc9ff8d01b3f54d805d Merge: 7df790890 09ea89764 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:40:36 2017 -0400 Merge branch 'trove-2017-008_030' into maint-0.3.0 changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 139bda4fe48e0cdba68c9e802be983fb971e55be Merge: 9d8d4cb3f 314652dc1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:40:40 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0

1 0

[tor/master] Merge branch 'maint-0.3.1'
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit c7d0096f9ddde0d8663b40f17110ded40309e09a Merge: dd8eeabfd 23c4592ee Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:42:30 2017 -0400 Merge branch 'maint-0.3.1' changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 23c4592ee98df59ccfe1a31bf714809caa78ca98 Merge: 49b5ad6b7 139bda4fe Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:40:40 2017 -0400 Merge branch 'maint-0.3.0' into maint-0.3.1 changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.9] Fix log-uninitialized-stack bug in rend_service_intro_established.
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 4a2cbea6ce585fcdaf86a80ccf39bceb4137e86a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:25:21 2017 -0400 Fix log-uninitialized-stack bug in rend_service_intro_established. Fixes bug 23490; bugfix on 0.2.7.2-alpha. TROVE-2017-008 CVE-2017-0380 --- changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/changes/trove-2017-008 b/changes/trove-2017-008 new file mode 100644 index 000000000..4b9c5b0a1 --- /dev/null +++ b/changes/trove-2017-008 @@ -0,0 +1,5 @@ + o Major bugfixes (security, hidden services, loggging): + - Fix a bug where we could log uninitialized stack when a certain + hidden service error occurred while SafeLogging was disabled. + Fixes bug #23490; bugfix on 0.2.7.2-alpha. + This is also tracked as TROVE-2017-008 and CVE-2017-0380. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index b81a01c56..0a5b5efd5 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -2859,6 +2859,8 @@ rend_service_intro_established(origin_circuit_t *circuit, (unsigned)circuit->base_.n_circ_id); goto err; } + base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1, + circuit->rend_data->rend_pk_digest, REND_SERVICE_ID_LEN); /* We've just successfully established a intro circuit to one of our * introduction point, account for it. */ intro = find_intro_point(circuit); @@ -2875,8 +2877,6 @@ rend_service_intro_established(origin_circuit_t *circuit, service->desc_is_dirty = time(NULL); circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_INTRO); - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1, - circuit->rend_data->rend_pk_digest, REND_SERVICE_ID_LEN); log_info(LD_REND, "Received INTRO_ESTABLISHED cell on circuit %u for service %s", (unsigned)circuit->base_.n_circ_id, serviceid);

1 0

[tor/maint-0.2.9] Merge branch 'trove-2017-008_028' into maint-0.2.8
by nickm＠torproject.org 18 Sep '17

18 Sep '17

commit 0ec72b030839c3a9e8c557483594b9dbe86c0792 Merge: 26f68dfce 4a2cbea6c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 18 09:39:35 2017 -0400 Merge branch 'trove-2017-008_028' into maint-0.2.8 changes/trove-2017-008 | 5 +++++ src/or/rendservice.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-)

1 0