CVE-2019-20892 (C, published 2020-06-25T10:15Z)
Description: value: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/net-snmp/net-snmp
Files changed:
snmplib/snmp_client.c
snmplib/snmpusm.c
Commit message: libsnmp, USM: Introduce a reference count in struct usmStateReference

This patch fixes https://sourceforge.net/p/net-snmp/bugs/2956/.


Vulnerable code:
    if (pdu->securityStateRef &&
        pdu->command == SNMP_MSG_TRAP2) {

        netsnmp_assert(pdu->securityModel == SNMP_DEFAULT_SECMODEL);
        ret = usm_clone_usmStateReference((struct usmStateReference *) pdu->securityStateRef,
                (struct usmStateReference **) &newpdu->securityStateRef );

        if (ret)
        {
    if ((sptr = find_sec_mod(newpdu->securityModel)) != NULL &&
        sptr->pdu_clone != NULL) {
        /*
         * call security model if it needs to know about this 
         */
        (*sptr->pdu_clone) (pdu, newpdu);
    }

    struct usmStateReference *retval = (struct usmStateReference *)
        calloc(1, sizeof(struct usmStateReference));
    struct usmStateReference *old_ref = (struct usmStateReference *) old;

    if (old_ref) {

        if (old_ref->usr_name_length)
            SNMP_FREE(old_ref->usr_name);
        if (old_ref->usr_engine_id_length)
            SNMP_FREE(old_ref->usr_engine_id);
        if (old_ref->usr_auth_protocol_length)
            SNMP_FREE(old_ref->usr_auth_protocol);
        if (old_ref->usr_priv_protocol_length)
            SNMP_FREE(old_ref->usr_priv_protocol);

        if (old_ref->usr_auth_key_length && old_ref->usr_auth_key) {
            SNMP_ZERO(old_ref->usr_auth_key, old_ref->usr_auth_key_length);
            SNMP_FREE(old_ref->usr_auth_key);
        }
        if (old_ref->usr_priv_key_length && old_ref->usr_priv_key) {
            SNMP_ZERO(old_ref->usr_priv_key, old_ref->usr_priv_key_length);
            SNMP_FREE(old_ref->usr_priv_key);
        }
        SNMP_ZERO(old_ref, sizeof(*old_ref));
        SNMP_FREE(old_ref);

Fixed code:
    sptr = find_sec_mod(newpdu->securityModel);
    if (sptr && sptr->pdu_clone) {
        /* call security model if it needs to know about this */
        ret = sptr->pdu_clone(pdu, newpdu);
        if (ret) {
    int             refcnt;
    struct usmStateReference *retval;

    retval = calloc(1, sizeof(struct usmStateReference));
    if (retval)
        retval->refcnt = 1;
static int
usm_clone(netsnmp_pdu *pdu, netsnmp_pdu *new_pdu)
{
    struct usmStateReference *ref = pdu->securityStateRef;
    struct usmStateReference **new_ref =
        (struct usmStateReference **)&new_pdu->securityStateRef;
    int ret = 0;

    if (!ref)
        return ret;

    if (pdu->command == SNMP_MSG_TRAP2) {
        netsnmp_assert(pdu->securityModel == SNMP_DEFAULT_SECMODEL);
        ret = usm_clone_usmStateReference(ref, new_ref);
    } else {
        netsnmp_assert(ref == *new_ref);
        ref->refcnt++;
    }

    return ret;
}

    struct usmStateReference *ref = old;

    if (!ref)
        return;

    if (--ref->refcnt > 0)
        return;
    SNMP_FREE(ref->usr_name);
    SNMP_FREE(ref->usr_engine_id);
    SNMP_FREE(ref->usr_auth_protocol);
    SNMP_FREE(ref->usr_priv_protocol);
    if (ref->usr_auth_key_length && ref->usr_auth_key) {
        SNMP_ZERO(ref->usr_auth_key, ref->usr_auth_key_length);
        SNMP_FREE(ref->usr_auth_key);
    }
    if (ref->usr_priv_key_length && ref->usr_priv_key) {
        SNMP_ZERO(ref->usr_priv_key, ref->usr_priv_key_length);
        SNMP_FREE(ref->usr_priv_key);
    SNMP_FREE(ref);
    def->pdu_clone = usm_clone;