#1875 snmpwalk or snmpgetnext cause snmpd segfault

[Anonymous]

This is a x86_64 only issue on rhel5.

# cat /etc/issue
Red Hat Enterprise Linux Server release 5 (Tikanga)
Kernel \r on an \m

#uname -a
Linux vm-rles5 2.6.18-8.el5xen #1 SMP Fri Jan 26 14:29:35 EST 2007 x86_64 x86_64 x86_64 GNU/Linux

net-snmp-5.3.1-14.el5
net-snmp-utils-5.3.1-14.el5

Reproduce steps:
1. leave only one line in /etc/snmp/snmpd.conf
rwcommunity public 127.0.0.1
2. Startup snmpd
3. #snmpwalk -O s -v 1 -c public -m all localhost tcpOutRsts.0

Result:
snmpd is killed.

#tail /var/log/messages
Jun 18 21:24:02 vm-rles5 snmpd[3833]: Connection from UDP: [127.0.0.1]:32797
Jun 18 21:24:02 vm-rles5 last message repeated 275 times
Jun 18 21:24:02 vm-rles5 snmpd[3833]: ipSystemStatsTable node ipSystemStatsOutFragOKs not implemented: skipping
Jun 18 21:24:02 vm-rles5 snmpd[3833]: ipSystemStatsTable node ipSystemStatsOutFragOKs not implemented: skipping
Jun 18 21:24:02 vm-rles5 snmpd[3833]: Connection from UDP: [127.0.0.1]:32797
Jun 18 21:24:02 vm-rles5 last message repeated 197 times
Jun 18 21:24:03 vm-rles5 kernel: snmpd[3833]: segfault at 000055756cdc762c rip 00002aaaab6cdc56 rsp 00007fff80111ff0 error 6

gdb backtrace:
Connection from UDP: [127.0.0.1]:32797

---Type <return> to continue, or q <return> to quit---
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46912544193392 (LWP 3894)]
0x00002aaaab6cdc56 in netsnmp_hex_to_binary () from /usr/lib64/libnetsnmp.so.10
(gdb) bt
#0 0x00002aaaab6cdc56 in netsnmp_hex_to_binary ()
from /usr/lib64/libnetsnmp.so.10
#1 0x00002aaaaad6ac38 in netsnmp_arch_tcpconn_container_load ()
from /usr/lib64/libnetsnmpmibs.so.10
#2 0x00002aaaaad6a537 in netsnmp_access_tcpconn_container_load ()
from /usr/lib64/libnetsnmpmibs.so.10
#3 0x00002aaaaad6e6d5 in tcpConnectionTable_container_load ()
from /usr/lib64/libnetsnmpmibs.so.10
#4 0x00002aaaab25b2b4 in netsnmp_cache_timer_start ()
from /usr/lib64/libnetsnmphelpers.so.10
#5 0x00002aaaab25ba00 in netsnmp_cache_helper_handler ()
from /usr/lib64/libnetsnmphelpers.so.10
#6 0x00002aaaab0276ae in netsnmp_call_handler ()
from /usr/lib64/libnetsnmpagent.so.10
#7 0x00002aaaab26ad44 in table_helper_handler ()
from /usr/lib64/libnetsnmphelpers.so.10
#8 0x00002aaaab0276ae in netsnmp_call_handler ()
from /usr/lib64/libnetsnmpagent.so.10
#9 0x00002aaaab01ac3f in handle_var_requests ()
from /usr/lib64/libnetsnmpagent.so.10
#10 0x00002aaaab01bcc0 in handle_getnext_loop ()
from /usr/lib64/libnetsnmpagent.so.10
#11 0x00002aaaab01d108 in netsnmp_handle_request ()
---Type <return> to continue, or q <return> to quit---
from /usr/lib64/libnetsnmpagent.so.10
#12 0x00002aaaab01dce7 in handle_snmp_packet ()
from /usr/lib64/libnetsnmpagent.so.10
#13 0x00002aaaab6b97aa in snmpv3_parse () from /usr/lib64/libnetsnmp.so.10
#14 0x00002aaaab6ba791 in _sess_read () from /usr/lib64/libnetsnmp.so.10
#15 0x00002aaaab6bb1f9 in snmp_sess_read () from /usr/lib64/libnetsnmp.so.10
#16 0x00002aaaab6bb243 in snmp_read () from /usr/lib64/libnetsnmp.so.10
#17 0x0000555555559186 in main () from /usr/sbin/snmpd</return></return></return></return>

[tommyyan]

Logged In: YES
user_id=1113202
Originator: NO

I forgot to login. It's me submitting this issue.
- Tommy

[Thomas Anders]

Logged In: YES
user_id=848638
Originator: NO

Please note that you're submitting a bug against a private RHEL package patched by Red Hat. Has this also been submitted to RH?
What's the output of "net-snmp-config --configure-options" or "snmpget ... localhost UCD-SNMP-MIB::versionConfigureOptions.0"?
Most importantly, can you reproduce the issue with net-snmp 5.3.2.pre1 and/or 5.4.1?

[tommyyan]

Logged In: YES
user_id=1113202
Originator: NO

I cannot reproduce it on net-snmp 5.3.2.pre1, the Redhat code is wrong. So, pls close this.