Skip to content

Commit

Permalink
AgentX: Fix a use-after-free
Browse files Browse the repository at this point in the history 
When calling snmp_async_send(), the callback function is called whether or
not sending succeeds. Since the agentx_got_response() callback function
frees the cache unconditionally, calling netsnmp_free_delegated_cache()
explicitly after snmp_async_send() is wrong.

See also https://sourceforge.net/p/net-snmp/bugs/2943/.

Fixes: f9304c8 ("CHANGES: PATCH 1633670: fixed snmpd crashing when an AgentX subagent disconnect in the middle of processing of a request.") # v5.8.
  • Loading branch information
@bvanassche
bvanassche committed Aug 6, 2019
1 parent f797268 commit f3e8074
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions agent/mibgroup/agentx/master.c
View file
Expand Up @@ -616,8 +616,6 @@ agentx_master_handler(netsnmp_mib_handler *handler,
result = snmp_async_send(ax_session, pdu, agentx_got_response, cb_data);
if (result == 0) {
snmp_free_pdu(pdu);
if (cb_data)
netsnmp_free_delegated_cache((netsnmp_delegated_cache*) cb_data);
}

return SNMP_ERR_NOERROR;
Expand Down

3 comments on commit f3e8074

@setharnold
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello Bart, do you know if a CVE was assigned to this issue? if not, would a CVE be appropriate?

Thanks

@bvanassche
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello Bart, do you know if a CVE was assigned to this issue? if not, would a CVE be appropriate?

I do not know who assigns CVE numbers to Net-SNMP issues.

@setharnold
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably Net-SNMP is 'in-scope' for half-dozen or more cve number authorities; red hat, debian, suse, ubuntu, github, mitre, come to mind quickly, I'm sure there's others, too.

Unfortunately, I've now lost the thread of what prompted my question in the first place, I'm surprised it took me two weeks to get back to this.

Anyway, is this the sort of thing that'd be 'under control of an attacker' in any way? It's hard for me to judge in isolation, it feels like it's just a bug, but if this could allow a malicious entity to gain control over Net-SNMP, or deprive others of the legitimate use of it, it's probably worth drawing attention to it with a CVE.

Thanks

Please sign in to comment.