1 |
commit: 623b0c1dc6d907b02f350d18fb3d60ecc9c97a63 |
2 |
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Feb 16 18:20:06 2019 +0000 |
4 |
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Feb 16 18:23:03 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=623b0c1d |
7 |
|
8 |
kde-frameworks/kauth: Fix CVE-2019-7443 |
9 |
|
10 |
kauth: Insecure handling of arguments in helpers |
11 |
|
12 |
KAuth allows to pass parameters with arbitrary types to helpers running as root |
13 |
over DBus. Certain types can cause crashes and trigger decoding arbitrary |
14 |
images with dynamically loaded plugins. |
15 |
|
16 |
Package-Manager: Portage-2.3.60, Repoman-2.3.12 |
17 |
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org> |
18 |
|
19 |
.../kauth/files/kauth-5.54.0-CVE-2019-7443.patch | 68 ++++++++++++++++++++++ |
20 |
kde-frameworks/kauth/kauth-5.54.0-r1.ebuild | 43 ++++++++++++++ |
21 |
2 files changed, 111 insertions(+) |
22 |
|
23 |
diff --git a/kde-frameworks/kauth/files/kauth-5.54.0-CVE-2019-7443.patch b/kde-frameworks/kauth/files/kauth-5.54.0-CVE-2019-7443.patch |
24 |
new file mode 100644 |
25 |
index 00000000000..5b11cd8f5e9 |
26 |
--- /dev/null |
27 |
+++ b/kde-frameworks/kauth/files/kauth-5.54.0-CVE-2019-7443.patch |
28 |
@@ -0,0 +1,68 @@ |
29 |
+From fc70fb0161c1b9144d26389434d34dd135cd3f4a Mon Sep 17 00:00:00 2001 |
30 |
+From: Albert Astals Cid <aacid@×××.org> |
31 |
+Date: Sat, 2 Feb 2019 14:35:25 +0100 |
32 |
+Subject: Remove support for passing gui QVariants to KAuth helpers |
33 |
+ |
34 |
+Supporting gui variants is very dangerous since they can end up triggering |
35 |
+image loading plugins which are one of the biggest vectors for crashes, which |
36 |
+for very smart people mean possible code execution, which is very dangerous |
37 |
+in code that is executed as root. |
38 |
+ |
39 |
+We've checked all the KAuth helpers inside KDE git and none seems to be using |
40 |
+gui variants, so we're not actually limiting anything that people wanted to do. |
41 |
+ |
42 |
+Reviewed by security@×××.org and Aleix Pol |
43 |
+ |
44 |
+Issue reported by Fabian Vogt |
45 |
+--- |
46 |
+ src/backends/dbus/DBusHelperProxy.cpp | 9 +++++++++ |
47 |
+ src/kauthaction.h | 2 ++ |
48 |
+ 2 files changed, 11 insertions(+) |
49 |
+ |
50 |
+diff --git a/src/backends/dbus/DBusHelperProxy.cpp b/src/backends/dbus/DBusHelperProxy.cpp |
51 |
+index 10c14c6..8f0d336 100644 |
52 |
+--- a/src/backends/dbus/DBusHelperProxy.cpp |
53 |
++++ b/src/backends/dbus/DBusHelperProxy.cpp |
54 |
+@@ -31,6 +31,8 @@ |
55 |
+ #include "kf5authadaptor.h" |
56 |
+ #include "kauthdebug.h" |
57 |
+ |
58 |
++extern Q_CORE_EXPORT const QMetaTypeInterface *qMetaTypeGuiHelper; |
59 |
++ |
60 |
+ namespace KAuth |
61 |
+ { |
62 |
+ |
63 |
+@@ -229,10 +231,17 @@ QByteArray DBusHelperProxy::performAction(const QString &action, const QByteArra |
64 |
+ return ActionReply::HelperBusyReply().serialized(); |
65 |
+ } |
66 |
+ |
67 |
++ // Make sure we don't try restoring gui variants, in particular QImage/QPixmap/QIcon are super dangerous |
68 |
++ // since they end up calling the image loaders and thus are a vector for crashing → executing code |
69 |
++ auto origMetaTypeGuiHelper = qMetaTypeGuiHelper; |
70 |
++ qMetaTypeGuiHelper = nullptr; |
71 |
++ |
72 |
+ QVariantMap args; |
73 |
+ QDataStream s(&arguments, QIODevice::ReadOnly); |
74 |
+ s >> args; |
75 |
+ |
76 |
++ qMetaTypeGuiHelper = origMetaTypeGuiHelper; |
77 |
++ |
78 |
+ m_currentAction = action; |
79 |
+ emit remoteSignal(ActionStarted, action, QByteArray()); |
80 |
+ QEventLoop e; |
81 |
+diff --git a/src/kauthaction.h b/src/kauthaction.h |
82 |
+index c67a70a..01f3ba1 100644 |
83 |
+--- a/src/kauthaction.h |
84 |
++++ b/src/kauthaction.h |
85 |
+@@ -298,6 +298,8 @@ public: |
86 |
+ * This method sets the variant map that the application |
87 |
+ * can use to pass arbitrary data to the helper when executing the action. |
88 |
+ * |
89 |
++ * Only non-gui variants are supported. |
90 |
++ * |
91 |
+ * @param arguments The new arguments map |
92 |
+ */ |
93 |
+ void setArguments(const QVariantMap &arguments); |
94 |
+-- |
95 |
+cgit v1.1 |
96 |
+ |
97 |
|
98 |
diff --git a/kde-frameworks/kauth/kauth-5.54.0-r1.ebuild b/kde-frameworks/kauth/kauth-5.54.0-r1.ebuild |
99 |
new file mode 100644 |
100 |
index 00000000000..8c8a8020545 |
101 |
--- /dev/null |
102 |
+++ b/kde-frameworks/kauth/kauth-5.54.0-r1.ebuild |
103 |
@@ -0,0 +1,43 @@ |
104 |
+# Copyright 1999-2019 Gentoo Authors |
105 |
+# Distributed under the terms of the GNU General Public License v2 |
106 |
+ |
107 |
+EAPI=6 |
108 |
+ |
109 |
+VIRTUALX_REQUIRED="test" |
110 |
+inherit kde5 |
111 |
+ |
112 |
+DESCRIPTION="Framework to let applications perform actions as a privileged user" |
113 |
+LICENSE="LGPL-2.1+" |
114 |
+KEYWORDS="~amd64 ~arm ~arm64 ~x86" |
115 |
+IUSE="nls +policykit" |
116 |
+ |
117 |
+RDEPEND=" |
118 |
+ $(add_frameworks_dep kcoreaddons) |
119 |
+ $(add_qt_dep qtdbus) |
120 |
+ $(add_qt_dep qtgui) |
121 |
+ $(add_qt_dep qtwidgets) |
122 |
+ policykit? ( sys-auth/polkit-qt[qt5(+)] ) |
123 |
+" |
124 |
+DEPEND="${RDEPEND} |
125 |
+ nls? ( $(add_qt_dep linguist-tools) ) |
126 |
+" |
127 |
+PDEPEND="policykit? ( kde-plasma/polkit-kde-agent )" |
128 |
+ |
129 |
+PATCHES=( "${FILESDIR}/${P}-CVE-2019-7443.patch" ) |
130 |
+ |
131 |
+src_configure() { |
132 |
+ local mycmakeargs=( |
133 |
+ $(cmake-utils_use_find_package policykit PolkitQt5-1) |
134 |
+ ) |
135 |
+ |
136 |
+ kde5_src_configure |
137 |
+} |
138 |
+ |
139 |
+src_test() { |
140 |
+ # KAuthHelperTest test fails, bug 654842 |
141 |
+ local myctestargs=( |
142 |
+ -E "(KAuthHelperTest)" |
143 |
+ ) |
144 |
+ |
145 |
+ kde5_src_test |
146 |
+} |