From 7e8eec79880cc207ba61b662eb8b93081101b62c Mon Sep 17 00:00:00 2001 From: Alex Rousskov Date: Sun, 12 Nov 2023 09:33:20 +0000 Subject: [PATCH] Do not update StoreEntry expiration after errorAppendEntry() (#1580) errorAppendEntry() is responsible for setting entry expiration times, which it does by calling StoreEntry::storeErrorResponse() that calls StoreEntry::negativeCache(). This change was triggered by a vulnerability report by Joshua Rogers at https://megamansec.github.io/Squid-Security-Audit/cache-uaf.html where it was filed as "Use-After-Free in Cache Manager Errors". The reported "use after free" vulnerability was unknowingly addressed by 2022 commit 1fa761a that removed excessively long "reentrant" store_client calls responsible for the disappearance of the properly locked StoreEntry in this (and probably other) contexts. --- src/cache_manager.cc | 1 - 1 file changed, 1 deletion(-) diff --git a/src/cache_manager.cc b/src/cache_manager.cc index dbb99d9f01..9348fdc128 100644 --- a/src/cache_manager.cc +++ b/src/cache_manager.cc @@ -332,7 +332,6 @@ CacheManager::start(const Comm::ConnectionPointer &client, HttpRequest *request, err->url = xstrdup(entry->url()); err->detailError(new ExceptionErrorDetail(Here().id())); errorAppendEntry(entry, err); - entry->expires = squid_curtime; return; } -- 2.47.2