GHSA-xvvw-4j77-rp7q: Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, checkicmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing processarguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where checkicmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use capnetraw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Monitoring Plugins check_icmpto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Which installations face a privilege-escalation risk?
The privilege-escalation consequence applies where check_icmp is installed setuid root. Installations using cap_net_raw file capabilities instead of setuid are not exposed to that consequence.
What does an attacker need to trigger the memory corruption?
A local low-privileged attacker must supply more than 65,535 hosts through -H or --Host arguments, or through Host= entries in an --extra-opts file. The overflow occurs while processing those host entries, before the program drops root privileges.
What versions are affected and what version fixes the issue?
The affected range is from 3.0.0-rc1 through 3.0.1. The issue is fixed in version 3.0.1.
Has reliable root privilege escalation been demonstrated?
No. The available information states that reliable privilege escalation has not been demonstrated, although heap memory can be corrupted while a setuid-root process still has root privileges.