CVE-2026-73583: Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

AIONLYREPORT package: sblim-sfcb-1.4.9-36.el10 ------ Summary: Unsafe deserialization of provider-manager IPC message allows pointer/length manipulation (OOB read/write): malformed local IPC input can drive unchecked OperationHdr offset fixups and handler-table indexing in the provider-manager, leading to out-of-bounds access and process termination. Requirements to exploit: A local attacker needs access to a system running the package and a deployment where the local connect socket is reachable closely enough to obtain the internal provider-manager descriptor via MSGXLOCAL. No user interaction is required. Exposure depends on local IPC configuration and socket permissions. Component affected: sblim-sfcb-1.4.9-36.el10, provider-manager IPC request parsing in providerMgr.c (processProviderMgrRequests()), with the documented access path through localConnectServer() in msgqueue.c Version affected: sblim-sfcb-1.4.9-36.el10 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - 7.1 (HIGH) AV:L - Exploitation is through a local IPC channel rather than over the network. AC:L - Once the attacker can use the local connect path, crafting malformed OperationHdr fields is straightforward. PR:L - The attacker needs local access sufficient to reach the local connect socket and obtain the internal descriptor. UI:N - No user interaction is required. S:U - The impact is within the vulnerable service’s security scope. C:L - Limited unintended disclosure is plausible if invalid offsets are dereferenced into mapped memory and consumed by logging or downstream code, but broad disclosure is not established. I:L - Invalid handler selection and malformed in-buffer pointers can perturb control flow or request processing, but arbitrary write or privilege escalation is not demonstrated from the available evidence. A:H - A reliable crash of the provider-manager process is directly supported by the unchecked dereference and handler lookup. Impact: Moderate. Based on the Red Hat severity guidance, the available evidence supports a locally reachable denial of service and unsafe memory access in the provider-manager parser, but not an easy or established route to full system compromise. Reachability also depends on local IPC exposure and socket permissions, which makes this less severe than a typical Important or Critical issue. Embargo: no Reason: The issue is local and configuration-dependent, and the demonstrated impact is primarily local service disruption rather than easy remote compromise. Acknowledgement: Aisle Research Vulnerability Details: The directly reachable issue is in processProviderMgrRequests(). Fields from an IPC-supplied OperationHdr are trusted before validating that embedded offsets stay within the rl bytes returned by spRecvReq(), and req->type is used as a handler-table index without a bounds check. c spRecvReq(&sfcbSockets.receive, &requestor, (void ) &req, &rl, &mqg); req->nameSpace.data = (void )((long)req->nameSpace.data + (char )req); if (req->className.length) req->className.data = (void )((long)req->className.data + (char )req); SFCBTRACE(1, ("--- Mgr request for %s-%s (%d) from %d", req->nameSpace.data, req->className.data, req->type, requestor)); hdlr = mHandlers[req->type]; hdlr.handler(&requestor, req); A malformed message can therefore cause an out-of-bounds string dereference in the trace path or an invalid access to mHandlers[req->type], resulting in a crash and potentially other unsafe memory effects if the computed addresses remain mapped. The documented local access path is the local connect server, which hands out the internal send descriptor on a non-zero request: c if (msg.size != 0) { spSendCtlResult(&nsocket, &sfcbSockets.send, MSGXLOCAL, 0, 0, 0); } In the reviewed code path, no peer-credential validation is evident before that handoff. Exposure therefore depends on who can connect to the local socket in a given deployment. The separately noted arithmetic and copy pattern in getProviderContext() is worth hardening, but based on the available evidence it is better treated as defense-in-depth unless a distinct attacker-controlled path into ctx->oHdr is demonstrated. Steps to reproduce: 1. Build the package with -fsanitize=address,undefined for deterministic diagnostics. 2. Start sfcbd with the local connect socket enabled. The reviewed materials identify /tmp/sfcbLocalSocket as the default localSocketPath. 3. Connect to the local connect socket and send a non-zero local-connect request to receive the internal descriptor through the MSGXLOCAL path. 4. Use the received descriptor to send a crafted MSGDATA request containing an OperationHdr with either an out-of-range nameSpace.data offset or a type value larger than the mHandlers[] table. 5. Observe a crash or sanitizer finding during the %s trace dereference and/or the mHandlers[req->type] access in processProviderMgrRequests(). Mitigation: Restrict access to the local connect socket so untrusted local users cannot obtain the internal provider-manager descriptor. Deployments where only trusted users can reach that socket have materially reduced exposure until a fix is available. Proposed Fix: Validate the received message length, segment offsets and lengths, and the handler index before performing any pointer fixup or dispatch. A minimal patch for the directly reachable parser issue is: diff diff --git a/providerMgr.c b/providerMgr.c @@ +static int seginmsg(unsigned long rl, MsgSegment s) { + uintptrt off = (uintptrt)s.data; + sizet len = (sizet)s.length; + if (off > rl) return 0; + if (len > (sizet)(rl - off)) return 0; + return 1; +} @@ void processProviderMgrRequests() if (mqg.rdone) { + if (mqg.rdone) { + if (rl < sizeof(OperationHdr) || + !seginmsg(rl, req->nameSpace) || + (req->className.length && !seginmsg(rl, req->className)) || + req->type >= (sizeof(mHandlers) / sizeof(mHandlers[0])) || + mHandlers[req->type].handler == NULL) { + free(req); + if ((options & OHInternal) == 0) close(requestor); + continue; + } req->nameSpace.data = (void ) ((long) req->nameSpace.data + (char ) req); if (req->className.length) req->className.data = (void ) ((long) req->className.data + (char ) req);

Additional hardening: use overflow-safe arithmetic and null checks in getProviderContext(). ------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat