Repository navigation
[autobackport: sssd-2-13] kcm: do not hang on empty request message body - #9561
Merged
alexey-tikhonov merged 4 commits intoOct 26, 2026
Merged
alexey-tikhonov merged 4 commits into
alexey-tikhonov merged 4 commits into
Conversation
alexey-tikhonov
approved these changes
Oct 26, 2026
alexey-tikhonov
added
no-backport
The listening socket fd is non-blocking, but accept() does not propagate that flag to the accepted connection. KCM issues several I/O syscalls within a single tevent callback (read the length header then the body in kcm_recv_data(); write the length, retcode and payload in kcm_send_data()). A tevent event only guarantees the first syscall can make progress without blocking, so on a blocking fd a client that sends the 4-byte length header and withholds the body blocks readv() and hangs the entire single-threaded KCM responder event loop. Set the accepted fd non-blocking in kcm_connection_setup() so an incomplete transfer surfaces as EAGAIN and is retried on the next event. :fixes: CVE-2026-80048 Assisted-By: Claude Code (Opus 4.8) Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit d5f68d9)
Now that kcm_iovec_op() correctly returns EAGAIN on a partial body read, kcm_recv_data() is re-entered to resume the transfer. It re-allocated the body buffer on every entry, pointing v_msg.kiov_base at the new allocation while leaving nprocessed untouched: the previous partially-filled buffer was orphaned (a per-retry leak) and the already-read prefix of the new buffer was left uninitialized, corrupting the assembled message. Allocate the buffer only when kiov_base is still NULL, so re-entries keep filling the same allocation. Related to: CVE-2026-80048 Assisted-By: Claude Code (Opus 4.8) Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 2c8f638)
kcm_recv_data() validated only the upper bound of the attacker-controlled body length, accepting any value down to zero. A body shorter than the 4-byte protocol header (major, minor, opcode) can never be a valid KCM message, yet it was allocated, read, and only rejected deep in kcm_input_parse(). Reject msglen < KCM_MSG_HEADER_SIZE up front, before any allocation. The SAFEALIGN_*_CHECK macros already prevent out-of-bounds reads, so this is defense-in-depth and earlier, cheaper rejection. Assisted-By: Claude Code (Opus 4.8) Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 4a7e9ac)
This adds a new undocumented kcm "recv_timeout" option (defaults to 5s) and a timer on incoming request - the request payload must be read within the given time, otherwise the client connection is killed. Note that we can not just shorten the client_idle_timeout as that would prevent client reconnecting on interactive cli applications. See: 00ae18d Related to: CVE-2026-80048 Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 0721b66)
Contributor
Author
|
The pull request was accepted by @alexey-tikhonov with the following PR CI status: 🟢 CodeQL (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
sssd-bot
force-pushed
the
SSSD-sssd-backport-pr9530-to-sssd-2-13
branch
from
October 26, 2026 20:09
2ac29da to
f512c47
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automatic backport of PR#9530 kcm: do not hang on empty request message body to branch sssd-2-13, created by @pbrezina.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
d5f68d9 - KCM: set the client fd non-blocking to avoid event-loop hangs
2c8f638 - KCM: allocate body buffer only once
4a7e9ac - KCM: reject request bodies smaller than the protocol header
0721b66 - KCM: add kcm_recv_timeout to avoid stuck requests
Backported commits
Original Pull Request Body
KCM reads body lenght and body in two-step sequence. If a body lenght was send but the body was not, kcm hanged since the file descriptor was not set as non-blocking. When this was fixed, kcm allocated the body buffer again and again on each read interupt, so now we allocate it only once.
Additionally, pre-existing mechanism guarantees that there can only be one running KCM requests per-connection by making the conn fd unreadable. It is set readable again only when we sent the reply. (This was already implemented)
Together this fixes CVE-2026-80048.
As a bonus, I added a simple sanity check for the body.