From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Mon, 30 Mar 2015 12:41:37 +0000 (+0200)
Subject: addrfilt: fix access configuration with subnet size indivisible by 4
X-Git-Tag: 1.31.1~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf19042ecb656b8afec0cc4906e7dd3ea9266ac8;p=thirdparty%2Fchrony.git

addrfilt: fix access configuration with subnet size indivisible by 4

When NTP or cmdmon access was configured (from chrony.conf or via
authenticated cmdmon) with a subnet size that is indivisible by 4 and
an address that has nonzero bits in the 4-bit subnet remainder (e.g.
192.168.15.0/22 or f000::/3), the new setting was written to an
incorrect location, possibly outside the allocated array.

An attacker that has the command key and is allowed to access cmdmon
(only localhost is allowed by default) could exploit this to crash
chronyd or possibly execute arbitrary code with the privileges of the
chronyd process.
---

diff --git a/addrfilt.c b/addrfilt.c
index 0930289d..4b8879ac 100644
--- a/addrfilt.c
+++ b/addrfilt.c
@@ -199,7 +199,10 @@ set_subnet(TableNode *start_node,
 
       /* How many subnet entries to set : 1->8, 2->4, 3->2 */
       N = 1 << (NBITS-bits_to_go);
-      subnet = get_subnet(ip, bits_consumed);
+
+      subnet = get_subnet(ip, bits_consumed) & ~(N - 1);
+      assert(subnet + N <= TABLE_SIZE);
+
       if (!(node->extended)) {
         open_node(node);
       }