Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Paul Pluzhnikov <ppluzhnikov () gmail com>]

On Wed, Jan 28, 2015 at 3:04 AM, Hanno Böck <hanno () hboeck de> wrote:

> I'm CC-ing the committer. Maybe we can shed some light on this.
>
> Two people having fixed this in different places without crying alarm -
> it's worrying.

I used to maintain GLIBC that is used in Google production.

An internal bug report (b/14129807) was filed on 2014/04/17 when a
Googler noticed that gethostname("000...0") (with a 1000 zeros)
resulted in a buffer overflow detected by address sanitizer.

I didn't investigate whether the bug is exploitable or not (I just
assume that all buffer overflows should be patched). I simply noticed
that upstream has already fixed the issue, and so we backported the
patch as we routinely do for other buffer overflows.

Chromium team also got notified about the internal bug, and applied
the patch as well.

If I was supposed to cry alarm, I would have to cry alarm every time
there is a buffer overflow in glibc, which doesn't seem very useful.

Cheers,

-- 
Paul Pluzhnikov