CVE-2018-10850: Race Condition
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
Other sources
The bug is related to incoming connection handling in DS. A connection data structure contains a refcnt. The refcnt accounts the number of pending requests. When a connection needs to be cleanup (upon closure, timeout...) the core server waits for refcnt to be 0. It basically waits for all pending requests to complete before cleaning the structure.
The refcnt does not account specific LDAP request (persistent search), so if an event occurs on the connection (closure) the core server may reset the structure although a request is still going on.
Anonymous user are allowed to trigger a persistent search so in theory anyone sending persistent search and closing the connection hits that bug. Under normal use, most of the time the problem is not detected. Sometime there are error written in the log when an invalid refcnt is found. But depending on dispatch dynamic of the threads handling connection event it can crash.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-10850?
CVE-2018-10850 is a vulnerability in 389-ds-base before versions 1.4.0.10 and 1.3.8.3.
What is the severity of CVE-2018-10850?
The severity of CVE-2018-10850 is high with a severity value of 5.9.
How does CVE-2018-10850 impact 389-ds-base?
CVE-2018-10850 could result in a race condition in 389-ds-base, causing a crash if the server is under load.
How can an attacker exploit CVE-2018-10850?
An anonymous attacker could trigger a denial of service by exploiting CVE-2018-10850.
How can I fix CVE-2018-10850?
To fix CVE-2018-10850, update to versions 1.4.0.10 or 1.3.8.3 of 389-ds-base.