16accb6b24
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
66 lines
1.9 KiB
Diff
66 lines
1.9 KiB
Diff
From 84f378d3b8573828e7ccc54b54b5e128aa993748 Mon Sep 17 00:00:00 2001
|
|
From: Matthias Gerstner <matthias.gerstner@suse.de>
|
|
Date: Wed, 27 Dec 2023 14:01:59 +0100
|
|
Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent
|
|
local DoS situations
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
|
|
being placed in user controlled directories, causing the PAM module to
|
|
block indefinitely during `openat()`.
|
|
|
|
Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
|
|
refer to a directory.
|
|
|
|
With this the check whether the final path element is a directory
|
|
becomes unnecessary, drop it.
|
|
|
|
Upstream-Status: Backport [https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb]
|
|
CVE: CVE-2024-22365
|
|
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
|
|
---
|
|
modules/pam_namespace/pam_namespace.c | 18 +-----------------
|
|
1 file changed, 1 insertion(+), 17 deletions(-)
|
|
|
|
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
|
|
index f34ce934..ef856443 100644
|
|
--- a/modules/pam_namespace/pam_namespace.c
|
|
+++ b/modules/pam_namespace/pam_namespace.c
|
|
@@ -1194,7 +1194,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
|
|
int dfd = AT_FDCWD;
|
|
int dfd_next;
|
|
int save_errno;
|
|
- int flags = O_RDONLY;
|
|
+ int flags = O_RDONLY | O_DIRECTORY;
|
|
int rv = -1;
|
|
struct stat st;
|
|
|
|
@@ -1248,22 +1248,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
|
|
rv = openat(dfd, dir, flags);
|
|
}
|
|
|
|
- if (rv != -1) {
|
|
- if (fstat(rv, &st) != 0) {
|
|
- save_errno = errno;
|
|
- close(rv);
|
|
- rv = -1;
|
|
- errno = save_errno;
|
|
- goto error;
|
|
- }
|
|
- if (!S_ISDIR(st.st_mode)) {
|
|
- close(rv);
|
|
- errno = ENOTDIR;
|
|
- rv = -1;
|
|
- goto error;
|
|
- }
|
|
- }
|
|
-
|
|
if (flags & O_NOFOLLOW) {
|
|
/* we are inside user-owned dir - protect */
|
|
if (protect_mount(rv, p, idata) == -1) {
|
|
--
|
|
2.43.0
|
|
|