Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1049987

Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes

Show all headers | View raw

Package: iproute2
Version: 5.10.0-4
Severity: normal
Tags: ipv6

Dear Maintainer,

   * What led up to the situation?

Using ip -6 -r route shows (on 10.8) either an information leak:
$ ip -6 -r r
+U dev lo proto kernel metric 256 pref medium

or (on testing) empty output:

$ ip -6 -r r
 dev lo proto kernel metric 256 pref medium

for the resolved hostname.

   * What outcome did you expect instead?

Printing of the resolved name, e.g. 'localhost' for dev lo.

Reading the source and a bit of printf debugging i can see it's
in lib/utils.c, format_host_r:

1113z20n
1113    const char *format_host_r(int af, int len, const void *addr,
1114                            char *buf, int buflen)
1115    {
1116    #ifdef RESOLVE_HOSTNAMES
1117            if (resolve_hosts) {
1118                    const char *n;
1119
1120                    puts("XXX: here");
1121                    len = len <= 0 ? af_byte_len(af) : len;
1122
1123                    if (len > 0 &&
1124                        (n = resolve_address(addr, len, af)) !=
NULL)
1125                    {
1126                            printf("n is '%s'\n", n);
1127                            strncpy(buf, n, buflen);
1128                            return n;
1129                    }
1130            }
1131    #endif


results in:
./ip/ip -6 -r r
XXX: here
n is 'localhost'
localhost dev lo proto kernel metric 256 pref medium


Something better then this awful hack should be implemented i guess.

Kind regards,

Axel Scheepers


-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-3-amd64 (SMP w/8 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages iproute2 depends on:
ii  debconf [debconf-2.0]  1.5.74
ii  libbpf0                1:0.3-2
ii  libbsd0                0.11.3-1
ii  libc6                  2.31-9
ii  libcap2                1:2.44-1
ii  libcap2-bin            1:2.44-1
ii  libdb5.3               5.3.28+dfsg1-0.8
ii  libelf1                0.183-1
ii  libmnl0                1.0.4-3
ii  libselinux1            3.1-3
ii  libxtables12           1.8.7-1

Versions of packages iproute2 recommends:
pn  libatm1  <none>

Versions of packages iproute2 suggests:
pn  iproute2-doc  <none>

-- debconf information:
  iproute2/setcaps: false

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes Axel Scheepers <axel.scheepers76@gmail.com> - 2021-02-26 21:50 +0100

csiph-web