CVE-2017-11171: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2017-07-11T20:29Z
Repository: https://github.com/GNOME/gnome-session
Language: C
Files changed: gnome-session/gsm-xsmp-client.c, gnome-session/gsm-xsmp-server.c
Commit date: 2010-03-09 01:29:50 +0100
Commit message: [gsm] Delay the creation of the GsmXSMPClient until it really exists

We used to create the GsmXSMPClient before the XSMP connection is really
accepted. This can lead to some issues, though. An example is:
https://bugzilla.gnome.org/show_bug.cgi?id=598211#c19. Quoting:

 "What is happening is that a new client (probably metacity in your
 case) is opening an ICE connection in the GSM_MANAGER_PHASE_END_SESSION
 phase, which causes a new GsmXSMPClient to be added to the client
 store. The GSM_MANAGER_PHASE_EXIT phase then begins before the client
 has had a chance to establish a xsmp connection, which means that
 client->priv->conn will not be initialized at the point that xsmp_stop
 is called on the new unregistered client."

The fix is to create the GsmXSMPClient object when there's a real XSMP
connection. This implies moving the timeout that makes sure we don't
have an empty client to the XSMP server.

https://bugzilla.gnome.org/show_bug.cgi?id=598211

Diff: diff --git a/gnome-session/gsm-xsmp-client.c b/gnome-session/gsm-xsmp-client.c
index 8ba1eb7b..9da5fdc0 100644
--- a/gnome-session/gsm-xsmp-client.c
+++ b/gnome-session/gsm-xsmp-client.c
@@ -49,11 +49,10 @@ struct GsmXSMPClientPrivate
 
         SmsConn    conn;
         IceConn    ice_connection;
 
         guint      watch_id;
-        guint      protocol_timeout;
 
         char      *description;
         GPtrArray *props;
 
         /* SaveYourself state */
@@ -113,26 +112,10 @@ client_iochannel_watch (GIOChannel    *channel,
         g_object_unref (client);
 
         return keep_going;
 }
 
-/* Called if too much time passes between the initial connection and
- * the XSMP protocol setup.
- */
-static gboolean
-_client_protocol_timeout (GsmXSMPClient *client)
-{
-        g_debug ("GsmXSMPClient: client_protocol_timeout for client '%s' in ICE status %d",
-                 client->priv->description,
-                 IceConnectionStatus (client->priv->ice_connection));
-
-        gsm_client_set_status (GSM_CLIENT (client), GSM_CLIENT_FAILED);
-        gsm_client_disconnected (GSM_CLIENT (client));
-
-        return FALSE;
-}
-
 static SmProp *
 find_property (GsmXSMPClient *client,
                const char    *name,
                int           *index)
 {
@@ -191,14 +174,10 @@ setup_connection (GsmXSMPClient *client)
                                                  G_IO_IN | G_IO_ERR,
                                                  (GIOFunc)client_iochannel_watch,
                                                  client);
         g_io_channel_unref (channel);
 
-        client->priv->protocol_timeout = g_timeout_add_seconds (5,
-                                                                (GSourceFunc)_client_protocol_timeout,
-                                                                client);
-
         set_description (client);
 
         g_debug ("GsmXSMPClient: New client '%s'", client->priv->description);
 }
 
@@ -867,14 +846,10 @@ gsm_xsmp_client_disconnect (GsmXSMPClient *client)
 
         if (client->priv->ice_connection != NULL) {
                 IceSetShutdownNegotiation (client->priv->ice_connection, FALSE);
                 IceCloseConnection (client->priv->ice_connection);
         }
-
-        if (client->priv->protocol_timeout > 0) {
-                g_source_remove (client->priv->protocol_timeout);
-        }
 }
 
 static void
 gsm_xsmp_client_finalize (GObject *object)
 {
@@ -1303,15 +1278,10 @@ gsm_xsmp_client_connect (GsmXSMPClient *client,
                          unsigned long *mask_ret,
                          SmsCallbacks  *callbacks_ret)
 {
         client->priv->conn = conn;
 
-        if (client->priv->protocol_timeout) {
-                g_source_remove (client->priv->protocol_timeout);
-                client->priv->protocol_timeout = 0;
-        }
-
         g_debug ("GsmXSMPClient: Initializing client %s", client->priv->description);
 
         *mask_ret = 0;
 
         *mask_ret |= SmsRegisterClientProcMask;
diff --git a/gnome-session/gsm-xsmp-server.c b/gnome-session/gsm-xsmp-server.c
index 991c895f..1f0e0455 100644
--- a/gnome-session/gsm-xsmp-server.c
+++ b/gnome-session/gsm-xsmp-server.c
@@ -89,48 +89,138 @@ G_DEFINE_TYPE (GsmXsmpServer, gsm_xsmp_server, G_TYPE_OBJECT)
 typedef struct {
         GsmXsmpServer *server;
         IceListenObj   listener;
 } GsmIceConnectionData;
 
+typedef struct {
+        guint watch_id;
+        guint protocol_timeout;
+} GsmIceConnectionWatch;
+
+static void
+disconnect_ice_connection (IceConn ice_conn)
+{
+        IceSetShutdownNegotiation (ice_conn, FALSE);
+        IceCloseConnection (ice_conn);
+}
+
+static void
+free_ice_connection_watch (GsmIceConnectionWatch *data)
+{
+        if (data->watch_id) {
+                g_source_remove (data->watch_id);
+                data->watch_id = 0;
+        }
+
+        if (data->protocol_timeout) {
+                g_source_remove (data->protocol_timeout);
+                data->protocol_timeout = 0;
+        }
+
+        g_free (data);
+}
+
+static gboolean
+ice_protocol_timeout (IceConn ice_conn)
+{
+        GsmIceConnectionWatch *data;
+
+        g_debug ("GsmXsmpServer: ice_protocol_timeout for IceConn %p with status %d",
+                 ice_conn, IceConnectionStatus (ice_conn));
+
+        data = ice_conn->context;
+
+        free_ice_connection_watch (data);
+        disconnect_ice_connection (ice_conn);
+
+        return FALSE;
+}
+
+static gboolean
+auth_iochannel_watch (GIOChannel   *source,
+                      GIOCondition  condition,
+                      IceConn       ice_conn)
+{
+
+        GsmIceConnectionWatch *data;
+        gboolean               keep_going;
+
+        data = ice_conn->context;
+
+        switch (IceProcessMessages (ice_conn, NULL, NULL)) {
+        case IceProcessMessagesSuccess:
+                keep_going = TRUE;
+                break;
+        case IceProcessMessagesIOError:
+                g_debug ("GsmXsmpServer: IceProcessMessages returned IceProcessMessagesIOError");
+                free_ice_connection_watch (data);
+                disconnect_ice_connection (ice_conn);
+                keep_going = FALSE;
+                break;
+        case IceProcessMessagesConnectionClosed:
+                g_debug ("GsmXsmpServer: IceProcessMessages returned IceProcessMessagesConnectionClosed");
+                free_ice_connection_watch (data);
+                keep_going = FALSE;
+                break;
+        default:
+                g_assert_not_reached ();
+        }
+
+        return keep_going;
+}
+
+/* IceAcceptConnection returns a new ICE connection that is in a "pending" state,
+ * this is because authentification may be necessary.
+ * So we've to authenticate it, before accept_xsmp_connection() is called.
+ * Then each GsmXSMPClient will have its own IceConn watcher
+ */
+static void
+auth_ice_connection (IceConn ice_conn)
+{
+        GIOChannel            *channel;
+        GsmIceConnectionWatch *data;
+        int                    fd;
+
+        g_debug ("GsmXsmpServer: auth_ice_connection()");
+
+        fd = IceConnectionNumber (ice_conn);
+        fcntl (fd, F_SETFD, fcntl (fd, F_GETFD, 0) | FD_CLOEXEC);
+        channel = g_io_channel_unix_new (fd);
+
+        data = g_new0 (GsmIceConnectionWatch, 1);
+        ice_conn->context = data;
+
+        data->protocol_timeout = g_timeout_add_seconds (5,
+                                                        (GSourceFunc)ice_protocol_timeout,
+                                                        ice_conn);
+        data->watch_id = g_io_add_watch (channel,
+                                         G_IO_IN | G_IO_ERR,
+                                         (GIOFunc)auth_iochannel_watch,
+                                         ice_conn);
+        g_io_channel_unref (channel);
+}
+
 /* This is called (by glib via xsmp->ice_connection_watch) when a
- * connection is first received on the ICE listening socket. (We
- * expect that the client will then initiate XSMP on the connection;
- * if it does not, GsmXSMPClient will eventually time out and close
- * the connection.)
- *
- * FIXME: it would probably make more sense to not create a
- * GsmXSMPClient object until accept_xsmp_connection, below (and to do
- * the timing-out here in xsmp.c).
+ * connection is first received on the ICE listening socket.
  */
 static gboolean
 accept_ice_connection (GIOChannel           *source,
                        GIOCondition          condition,
                        GsmIceConnectionData *data)
 {
-        IceListenObj    listener;
         IceConn         ice_conn;
         IceAcceptStatus status;
-        GsmClient      *client;
-        GsmXsmpServer  *server;
-
-        listener = data->listener;
-        server = data->server;
 
         g_debug ("GsmXsmpServer: accept_ice_connection()");
 
-        ice_conn = IceAcceptConnection (listener, &status);
+        ice_conn = IceAcceptConnection (data->listener, &status);
         if (status != IceAcceptSuccess) {
                 g_debug ("GsmXsmpServer: IceAcceptConnection returned %d", status);
                 return TRUE;
         }
 
-        client = gsm_xsmp_client_new (ice_conn);
-        ice_conn->context = client;
-
-        gsm_store_add (server->priv->client_store, gsm_client_peek_id (client), G_OBJECT (client));
-        /* the store will own the ref */
-        g_object_unref (client);
+        auth_ice_connection (ice_conn);
 
         return TRUE;
 }
 
 void
@@ -222,27 +312,35 @@ accept_xsmp_connection (SmsConn        sms_conn,
                         GsmXsmpServer *server,
                         unsigned long *mask_ret,
                         SmsCallbacks  *callbacks_ret,
                         char         **failure_reason_ret)
 {
-        IceConn        ice_conn;
-        GsmXSMPClient *client;
+        IceConn                ice_conn;
+        GsmClient             *client;
+        GsmIceConnectionWatch *data;
 
         /* FIXME: what about during shutdown but before gsm_xsmp_shutdown? */
         if (server->priv->xsmp_sockets == NULL) {
                 g_debug ("GsmXsmpServer: In shutdown, rejecting new client");
 
                 *failure_reason_ret = strdup (_("Refusing new client connection because the session is currently being shut down\n"));
                 return FALSE;
         }
 
         ice_conn = SmsGetIceConnection (sms_conn);
-        client = ice_conn->context;
+        data = ice_conn->context;
 
-        g_return_val_if_fail (client != NULL, TRUE);
+        /* Each GsmXSMPClient has its own IceConn watcher */
+        free_ice_connection_watch (data);
+
+        client = gsm_xsmp_client_new (ice_conn);
+
+        gsm_store_add (server->priv->client_store, gsm_client_peek_id (client), G_OBJECT (client));
+        /* the store will own the ref */
+        g_object_unref (client);
 
-        gsm_xsmp_client_connect (client, sms_conn, mask_ret, callbacks_ret);
+        gsm_xsmp_client_connect (GSM_XSMP_CLIENT (client), sms_conn, mask_ret, callbacks_ret);
 
         return TRUE;
 }
 
 static void

Vulnerable code:         guint      protocol_timeout;
/* Called if too much time passes between the initial connection and
 * the XSMP protocol setup.
 */
static gboolean
_client_protocol_timeout (GsmXSMPClient *client)
{
        g_debug ("GsmXSMPClient: client_protocol_timeout for client '%s' in ICE status %d",
                 client->priv->description,
                 IceConnectionStatus (client->priv->ice_connection));

        gsm_client_set_status (GSM_CLIENT (client), GSM_CLIENT_FAILED);
        gsm_client_disconnected (GSM_CLIENT (client));

        return FALSE;
}

        client->priv->protocol_timeout = g_timeout_add_seconds (5,
                                                                (GSourceFunc)_client_protocol_timeout,
                                                                client);


        if (client->priv->protocol_timeout > 0) {
                g_source_remove (client->priv->protocol_timeout);
        }
        if (client->priv->protocol_timeout) {
                g_source_remove (client->priv->protocol_timeout);
                client->priv->protocol_timeout = 0;
        }

 * connection is first received on the ICE listening socket. (We
 * expect that the client will then initiate XSMP on the connection;
 * if it does not, GsmXSMPClient will eventually time out and close
 * the connection.)
 *
 * FIXME: it would probably make more sense to not create a
 * GsmXSMPClient object until accept_xsmp_connection, below (and to do
 * the timing-out here in xsmp.c).
        IceListenObj    listener;
        GsmClient      *client;
        GsmXsmpServer  *server;

        listener = data->listener;
        server = data->server;
        ice_conn = IceAcceptConnection (listener, &status);
        client = gsm_xsmp_client_new (ice_conn);
        ice_conn->context = client;

        gsm_store_add (server->priv->client_store, gsm_client_peek_id (client), G_OBJECT (client));
        /* the store will own the ref */
        g_object_unref (client);
        IceConn        ice_conn;
        GsmXSMPClient *client;
        client = ice_conn->context;
        g_return_val_if_fail (client != NULL, TRUE);
        gsm_xsmp_client_connect (client, sms_conn, mask_ret, callbacks_ret);
Fixed code: typedef struct {
        guint watch_id;
        guint protocol_timeout;
} GsmIceConnectionWatch;

static void
disconnect_ice_connection (IceConn ice_conn)
{
        IceSetShutdownNegotiation (ice_conn, FALSE);
        IceCloseConnection (ice_conn);
}

static void
free_ice_connection_watch (GsmIceConnectionWatch *data)
{
        if (data->watch_id) {
                g_source_remove (data->watch_id);
                data->watch_id = 0;
        }

        if (data->protocol_timeout) {
                g_source_remove (data->protocol_timeout);
                data->protocol_timeout = 0;
        }

        g_free (data);
}

static gboolean
ice_protocol_timeout (IceConn ice_conn)
{
        GsmIceConnectionWatch *data;

        g_debug ("GsmXsmpServer: ice_protocol_timeout for IceConn %p with status %d",
                 ice_conn, IceConnectionStatus (ice_conn));

        data = ice_conn->context;

        free_ice_connection_watch (data);
        disconnect_ice_connection (ice_conn);

        return FALSE;
}

static gboolean
auth_iochannel_watch (GIOChannel   *source,
                      GIOCondition  condition,
                      IceConn       ice_conn)
{

        GsmIceConnectionWatch *data;
        gboolean               keep_going;

        data = ice_conn->context;

        switch (IceProcessMessages (ice_conn, NULL, NULL)) {
        case IceProcessMessagesSuccess:
                keep_going = TRUE;
                break;
        case IceProcessMessagesIOError:
                g_debug ("GsmXsmpServer: IceProcessMessages returned IceProcessMessagesIOError");
                free_ice_connection_watch (data);
                disconnect_ice_connection (ice_conn);
                keep_going = FALSE;
                break;
        case IceProcessMessagesConnectionClosed:
                g_debug ("GsmXsmpServer: IceProcessMessages returned IceProcessMessagesConnectionClosed");
                free_ice_connection_watch (data);
                keep_going = FALSE;
                break;
        default:
                g_assert_not_reached ();
        }

        return keep_going;
}

/* IceAcceptConnection returns a new ICE connection that is in a "pending" state,
 * this is because authentification may be necessary.
 * So we've to authenticate it, before accept_xsmp_connection() is called.
 * Then each GsmXSMPClient will have its own IceConn watcher
 */
static void
auth_ice_connection (IceConn ice_conn)
{
        GIOChannel            *channel;
        GsmIceConnectionWatch *data;
        int                    fd;

        g_debug ("GsmXsmpServer: auth_ice_connection()");

        fd = IceConnectionNumber (ice_conn);
        fcntl (fd, F_SETFD, fcntl (fd, F_GETFD, 0) | FD_CLOEXEC);
        channel = g_io_channel_unix_new (fd);

        data = g_new0 (GsmIceConnectionWatch, 1);
        ice_conn->context = data;

        data->protocol_timeout = g_timeout_add_seconds (5,
                                                        (GSourceFunc)ice_protocol_timeout,
                                                        ice_conn);
        data->watch_id = g_io_add_watch (channel,
                                         G_IO_IN | G_IO_ERR,
                                         (GIOFunc)auth_iochannel_watch,
                                         ice_conn);
        g_io_channel_unref (channel);
}

 * connection is first received on the ICE listening socket.
        ice_conn = IceAcceptConnection (data->listener, &status);
        auth_ice_connection (ice_conn);
        IceConn                ice_conn;
        GsmClient             *client;
        GsmIceConnectionWatch *data;
        data = ice_conn->context;
        /* Each GsmXSMPClient has its own IceConn watcher */
        free_ice_connection_watch (data);

        client = gsm_xsmp_client_new (ice_conn);

        gsm_store_add (server->priv->client_store, gsm_client_peek_id (client), G_OBJECT (client));
        /* the store will own the ref */
        g_object_unref (client);
        gsm_xsmp_client_connect (GSM_XSMP_CLIENT (client), sms_conn, mask_ret, callbacks_ret);