CVE-2022-2850: Null Pointer Dereference
A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
Other sources
Description of problem: Previously: https://bugzilla.redhat.com/showbug.cgi?id=1952907
This issue is not fixed completely and can be triggered by supplying a malformed cookie, for example -E sync=rp/foo
Thread 14 "ns-slapd" received signal SIGSEGV, Segmentation fault. 0x00007f7802ba38d6 in strcmpevex () from target:/lib64/libc.so.6 (gdb) bt #0 0x00007f7802ba38d6 in strcmpevex () at target:/lib64/libc.so.6 #1 0x00007f77fe926e9f in synccookieisvalid (refcookie=0x7f77febfaba0, testcookie=0x7f77febfab80) at ldap/servers/plugins/sync/syncutil.c:796 #2 synccookieisvalid (testcookie=0x7f77febfab80, refcookie=0x7f77febfaba0) at ldap/servers/plugins/sync/syncutil.c:789 #3 0x00007f77fe92aa7d in syncsrchrefreshpresearch (pb=0x7f77feb9fd00) at ldap/servers/plugins/sync/syncrefresh.c:135 #4 0x00007f7802e297d9 in plugincallfunc (list=0x7f77fe9ed800, operation=operation@entry=403, pb=pb@entry=0x7f77feb9fd00, callone=callone@entry=0) at ldap/servers/slapd/plugin.c:2001 #5 0x00007f7802e299e6 in plugincalllist (pb=0x7f77feb9fd00, operation=403, list=<optimized out>) at ldap/servers/slapd/plugin.c:1944 #6 plugincallplugins (pb=0x7f77feb9fd00, whichfunction=403) at ldap/servers/slapd/plugin.c:414 #7 0x00007f7802e222a9 in opsharedsearch (pb=pb@entry=0x7f77feb9fd00, sendresult=sendresult@entry=1) at ldap/servers/slapd/opshared.c:586 #8 0x0000556eb3f0db14 in dosearch (pb=<optimized out>) at ldap/servers/slapd/search.c:388 #9 0x0000556eb3efcb7f in connectiondispatchoperation (pb=0x7f77feb9fd00, op=<optimized out>, conn=<optimized out>) at ldap/servers/slapd/connection.c:659 #10 connectionthreadmain () at ldap/servers/slapd/connection.c:1785 #11 0x00007f780290ec34 in ptroot () at target:/lib64/libnspr4.so #12 0x00007f7802b75802 in startthread () at target:/lib64/libc.so.6 #13 0x00007f7802b15450 in clone3 () at target:/lib64/libc.so.6
Automated reproducer: https://github.com/389ds/389-ds-base/blob/main/dirsrvtests/tests/tickets/ticket48013test.py
Version-Release number of selected component (if applicable): 389-ds-base-2.0.x+ (earliest I was able to test was 2.0.5).
How reproducible: Deterministically
Steps to Reproduce: 1. https://github.com/389ds/389-ds-base/blob/main/dirsrvtests/tests/tickets/ticket48013test.py
Actual results: Server crashes
Expected results: Should return an error that the cookie is invalid and not crash.
Additional info: Upstream ticket: https://github.com/389ds/389-ds-base/issues/4711#issuecomment-1205100979
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2850?
CVE-2022-2850 is a vulnerability found in 389-ds-base that allows an authenticated attacker to cause a denial of service.
What is the severity of CVE-2022-2850?
The severity of CVE-2022-2850 is medium with a severity value of 6.5.
Which software versions are affected by CVE-2022-2850?
CVE-2022-2850 affects Redhat Directory Server versions 11.0 and 12.0, Redhat Enterprise Linux versions 6.0, 7.0, 8.0, and 9.0, Fedora versions 35 and 36, and Port389 389-ds-base versions between 2.0.0 and 2.4.1.
How can an attacker exploit CVE-2022-2850?
An authenticated attacker can exploit CVE-2022-2850 by using a specially crafted query to cause a NULL pointer dereference and trigger a denial of service.
Are there any references for CVE-2022-2850?
Yes, you can find references for CVE-2022-2850 at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1952907), [link2](https://github.com/389ds/389-ds-base/blob/main/dirsrvtests/tests/tickets/ticket48013_test.py), [link3](https://github.com/389ds/389-ds-base/issues/4711#issuecomment-1205100979).