PR#50830: Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free - 389-ds-base

389-ds-base

#50830 Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free

Closed 3 years ago by spichugi. Opened 4 years ago by mreynolds.

mreynolds/389-ds-base issue50829 into master

Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free

Mark Reynolds • 4 years ago

bb3ac59

ldap/servers/slapd/log.c

file modified

		`@@ -3259,6 +3259,12 @@`
		`logp = logp->l_next;`
		`slapi_ch_free((void **)&prev_log);`
		`}`
		`+`
		`+ /* reset the log struct */`
		`+ loginfo.log_access_logchain = NULL;`
		`+ loginfo.log_audit_logchain = NULL;`
		`+ loginfo.log_auditfail_logchain = NULL;`
		`+ loginfo.log_error_logchain = NULL;`
		`}`

		`#define ERRORSLOG 1`

mreynolds commented 4 years ago

Description:

When Disk Monitoring finds that disk space is too low it starts freeing up disk space by removing rotated logs. However the log list struct was not properly reset after freeing all the files in the list. This is what allowed the heap-use-after-free to occur.

relates: https://pagure.io/389-ds-base/issue/50829