Vulnerability: tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service
Vulnerability ID: CVE-2017-1000198
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/open-iscsi/tcmu-runner
Published: 2017-11-17
File: glfs.c
Commit message: glfs: discard glfs_check_config

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Commit author: Prasanna Kumar Kalever

Vulnerable version (before fix):
 static char* tcmu_get_path( struct tcmu_device *dev) 	return config; }   static bool glfs_check_config(const char *cfgstring, char **reason) { 	char *path; 	glfs_t *fs = NULL; 	glfs_fd_t *gfd = NULL; 	gluster_server *hosts = NULL; /* gluster server defination */ 	bool result = true;  	path = strchr(cfgstring, '/'); 	if (!path) { 		if (asprintf(reason, "No path found") == -1) 			*reason = NULL; 		result = false; 		goto done; 	} 	path += 1; /* get past '/' */  	fs = tcmu_create_glfs_object(path, &hosts); 	if (!fs) { 		tcmu_err("tcmu_create_glfs_object failed\n"); 		goto done; 	}  	gfd = glfs_open(fs, hosts->path, ALLOWED_BSOFLAGS); 	if (!gfd) { 		if (asprintf(reason, "glfs_open failed: %m") == -1) 			*reason = NULL; 		result = false; 		goto unref; 	}  	if (glfs_access(fs, hosts->path, R_OK|W_OK) == -1) { 		if (asprintf(reason, "glfs_access file not present, or not writable") == -1) 			*reason = NULL; 		result = false; 		goto unref; 	}  	goto done;  unref: 	gluster_cache_refresh(fs, path);  done: 	if (gfd) 		glfs_close(gfd); 	gluster_free_server(&hosts);  	return result; }  static int tcmu_glfs_open(struct tcmu_device *dev) { 	struct glfs_state *gfsp; struct tcmur_handler glfs_handler = { 	.subtype 	= "glfs", 	.cfg_desc	= glfs_cfg_desc,  	.check_config 	= glfs_check_config,  	.open 		= tcmu_glfs_open, 	.close 		= tcmu_glfs_close, 	.read 		= tcmu_glfs_read,

Fixed version (after fix):
 static char* tcmu_get_path( struct tcmu_device *dev) 	return config; }  static int tcmu_glfs_open(struct tcmu_device *dev) { 	struct glfs_state *gfsp; struct tcmur_handler glfs_handler = { 	.subtype 	= "glfs", 	.cfg_desc	= glfs_cfg_desc,  	.open 		= tcmu_glfs_open, 	.close 		= tcmu_glfs_close, 	.read 		= tcmu_glfs_read,

Patch:
patch: @@ -430,58 +430,6 @@ static char* tcmu_get_path( struct tcmu_device *dev)
 	return config;
 }
 
-
-static bool glfs_check_config(const char *cfgstring, char **reason)
-{
-	char *path;
-	glfs_t *fs = NULL;
-	glfs_fd_t *gfd = NULL;
-	gluster_server *hosts = NULL; /* gluster server defination */
-	bool result = true;
-
-	path = strchr(cfgstring, '/');
-	if (!path) {
-		if (asprintf(reason, "No path found") == -1)
-			*reason = NULL;
-		result = false;
-		goto done;
-	}
-	path += 1; /* get past '/' */
-
-	fs = tcmu_create_glfs_object(path, &hosts);
-	if (!fs) {
-		tcmu_err("tcmu_create_glfs_object failed\n");
-		goto done;
-	}
-
-	gfd = glfs_open(fs, hosts->path, ALLOWED_BSOFLAGS);
-	if (!gfd) {
-		if (asprintf(reason, "glfs_open failed: %m") == -1)
-			*reason = NULL;
-		result = false;
-		goto unref;
-	}
-
-	if (glfs_access(fs, hosts->path, R_OK|W_OK) == -1) {
-		if (asprintf(reason, "glfs_access file not present, or not writable") == -1)
-			*reason = NULL;
-		result = false;
-		goto unref;
-	}
-
-	goto done;
-
-unref:
-	gluster_cache_refresh(fs, path);
-
-done:
-	if (gfd)
-		glfs_close(gfd);
-	gluster_free_server(&hosts);
-
-	return result;
-}
-
 static int tcmu_glfs_open(struct tcmu_device *dev)
 {
 	struct glfs_state *gfsp;
@@ -681,8 +629,6 @@ struct tcmur_handler glfs_handler = {
 	.subtype 	= "glfs",
 	.cfg_desc	= glfs_cfg_desc,
 
-	.check_config 	= glfs_check_config,
-
 	.open 		= tcmu_glfs_open,
 	.close 		= tcmu_glfs_close,
 	.read 		= tcmu_glfs_read,
path: glfs.c