| 1 |
mgorny 12/04/05 11:15:27 |
| 2 |
|
| 3 |
Added: |
| 4 |
0001-util-never-follow-symlinks-in-rm_rf_children.patch |
| 5 |
Log: |
| 6 |
Version bump wrt bug #376047. |
| 7 |
|
| 8 |
(Portage version: 2.2.0_alpha99_p2/cvs/Linux x86_64) |
| 9 |
|
| 10 |
Revision Changes Path |
| 11 |
1.1 sys-apps/systemd/files/0001-util-never-follow-symlinks-in-rm_rf_children.patch |
| 12 |
|
| 13 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-apps/systemd/files/0001-util-never-follow-symlinks-in-rm_rf_children.patch?rev=1.1&view=markup |
| 14 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-apps/systemd/files/0001-util-never-follow-symlinks-in-rm_rf_children.patch?rev=1.1&content-type=text/plain |
| 15 |
|
| 16 |
Index: 0001-util-never-follow-symlinks-in-rm_rf_children.patch |
| 17 |
=================================================================== |
| 18 |
From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001 |
| 19 |
From: Michal Schmidt <mschmidt@××××××.com> |
| 20 |
Date: Fri, 2 Mar 2012 10:39:10 +0100 |
| 21 |
Subject: [PATCH] util: never follow symlinks in rm_rf_children() |
| 22 |
|
| 23 |
The function checks if the entry is a directory before recursing, but |
| 24 |
there is a window between the check and the open, during which the |
| 25 |
directory could be replaced with a symlink. |
| 26 |
|
| 27 |
CVE-2012-1174 |
| 28 |
https://bugzilla.redhat.com/show_bug.cgi?id=803358 |
| 29 |
--- |
| 30 |
src/util.c | 3 ++- |
| 31 |
1 file changed, 2 insertions(+), 1 deletion(-) |
| 32 |
|
| 33 |
diff --git a/src/util.c b/src/util.c |
| 34 |
index 20cbc2b..dfc1dc6 100644 |
| 35 |
--- a/src/util.c |
| 36 |
+++ b/src/util.c |
| 37 |
@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) { |
| 38 |
if (is_dir) { |
| 39 |
int subdir_fd; |
| 40 |
|
| 41 |
- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) { |
| 42 |
+ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); |
| 43 |
+ if (subdir_fd < 0) { |
| 44 |
if (ret == 0 && errno != ENOENT) |
| 45 |
ret = -errno; |
| 46 |
continue; |
| 47 |
-- |
| 48 |
1.7.9.4 |
Archives