CVE-2017-1000198: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2017-11-17T02:29Z
Repository: https://github.com/open-iscsi/tcmu-runner
Language: C
Files changed: glfs.c
Commit date: 2017-06-21 23:15:00 +0530
Commit message: glfs: discard glfs_check_config

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>

Diff: diff --git a/glfs.c b/glfs.c
index 691826c..a575dba 100644
--- a/glfs.c
+++ b/glfs.c
@@ -428,62 +428,10 @@ static char* tcmu_get_path( struct tcmu_device *dev)
 	config += 1; /* get past '/' */
 
 	return config;
 }
 
-
-static bool glfs_check_config(const char *cfgstring, char **reason)
-{
-	char *path;
-	glfs_t *fs = NULL;
-	glfs_fd_t *gfd = NULL;
-	gluster_server *hosts = NULL; /* gluster server defination */
-	bool result = true;
-
-	path = strchr(cfgstring, '/');
-	if (!path) {
-		if (asprintf(reason, "No path found") == -1)
-			*reason = NULL;
-		result = false;
-		goto done;
-	}
-	path += 1; /* get past '/' */
-
-	fs = tcmu_create_glfs_object(path, &hosts);
-	if (!fs) {
-		tcmu_err("tcmu_create_glfs_object failed\n");
-		goto done;
-	}
-
-	gfd = glfs_open(fs, hosts->path, ALLOWED_BSOFLAGS);
-	if (!gfd) {
-		if (asprintf(reason, "glfs_open failed: %m") == -1)
-			*reason = NULL;
-		result = false;
-		goto unref;
-	}
-
-	if (glfs_access(fs, hosts->path, R_OK|W_OK) == -1) {
-		if (asprintf(reason, "glfs_access file not present, or not writable") == -1)
-			*reason = NULL;
-		result = false;
-		goto unref;
-	}
-
-	goto done;
-
-unref:
-	gluster_cache_refresh(fs, path);
-
-done:
-	if (gfd)
-		glfs_close(gfd);
-	gluster_free_server(&hosts);
-
-	return result;
-}
-
 static int tcmu_glfs_open(struct tcmu_device *dev)
 {
 	struct glfs_state *gfsp;
 	int ret = 0;
 	char *config;
@@ -679,12 +627,10 @@ static const char glfs_cfg_desc[] =
 struct tcmur_handler glfs_handler = {
 	.name 		= "Gluster glfs handler",
 	.subtype 	= "glfs",
 	.cfg_desc	= glfs_cfg_desc,
 
-	.check_config 	= glfs_check_config,
-
 	.open 		= tcmu_glfs_open,
 	.close 		= tcmu_glfs_close,
 	.read 		= tcmu_glfs_read,
 	.write		= tcmu_glfs_write,
 	.flush		= tcmu_glfs_flush,

Vulnerable code: 
static bool glfs_check_config(const char *cfgstring, char **reason)
{
	char *path;
	glfs_t *fs = NULL;
	glfs_fd_t *gfd = NULL;
	gluster_server *hosts = NULL; /* gluster server defination */
	bool result = true;

	path = strchr(cfgstring, '/');
	if (!path) {
		if (asprintf(reason, "No path found") == -1)
			*reason = NULL;
		result = false;
		goto done;
	}
	path += 1; /* get past '/' */

	fs = tcmu_create_glfs_object(path, &hosts);
	if (!fs) {
		tcmu_err("tcmu_create_glfs_object failed\n");
		goto done;
	}

	gfd = glfs_open(fs, hosts->path, ALLOWED_BSOFLAGS);
	if (!gfd) {
		if (asprintf(reason, "glfs_open failed: %m") == -1)
			*reason = NULL;
		result = false;
		goto unref;
	}

	if (glfs_access(fs, hosts->path, R_OK|W_OK) == -1) {
		if (asprintf(reason, "glfs_access file not present, or not writable") == -1)
			*reason = NULL;
		result = false;
		goto unref;
	}

	goto done;

unref:
	gluster_cache_refresh(fs, path);

done:
	if (gfd)
		glfs_close(gfd);
	gluster_free_server(&hosts);

	return result;
}

	.check_config 	= glfs_check_config,