From 5a6379ac53e0050e3757484ed7ceb72d10257f30edcbd726009138103b4a3cc7 Mon Sep 17 00:00:00 2001 From: Frederic Crozat Date: Mon, 19 Mar 2012 10:27:58 +0000 Subject: [PATCH] - Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix CVE-2012-1174 (bnc#752281). OBS-URL: https://build.opensuse.org/package/show/Base:System/systemd?expand=0&rev=260 --- ...er-follow-symlinks-in-rm_rf_children.patch | 32 +++++++++++++++++++ systemd-gtk.changes | 6 ++++ systemd.changes | 6 ++++ systemd.spec | 2 ++ 4 files changed, 46 insertions(+) create mode 100644 0001-util-never-follow-symlinks-in-rm_rf_children.patch diff --git a/0001-util-never-follow-symlinks-in-rm_rf_children.patch b/0001-util-never-follow-symlinks-in-rm_rf_children.patch new file mode 100644 index 00000000..8f12746b --- /dev/null +++ b/0001-util-never-follow-symlinks-in-rm_rf_children.patch @@ -0,0 +1,32 @@ +From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001 +From: Michal Schmidt +Date: Fri, 2 Mar 2012 10:39:10 +0100 +Subject: [PATCH] util: never follow symlinks in rm_rf_children() + +The function checks if the entry is a directory before recursing, but +there is a window between the check and the open, during which the +directory could be replaced with a symlink. + +CVE-2012-1174 +https://bugzilla.redhat.com/show_bug.cgi?id=803358 +--- + src/util.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/src/util.c b/src/util.c +index 20cbc2b..dfc1dc6 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) { + if (is_dir) { + int subdir_fd; + +- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) { ++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); ++ if (subdir_fd < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; +-- +1.7.7 + diff --git a/systemd-gtk.changes b/systemd-gtk.changes index f66e124c..1a6c23fa 100644 --- a/systemd-gtk.changes +++ b/systemd-gtk.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Mar 19 10:11:23 UTC 2012 - fcrozat@suse.com + +- Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix + CVE-2012-1174 (bnc#752281). + ------------------------------------------------------------------- Fri Mar 16 09:21:54 UTC 2012 - fcrozat@suse.com diff --git a/systemd.changes b/systemd.changes index f66e124c..1a6c23fa 100644 --- a/systemd.changes +++ b/systemd.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Mar 19 10:11:23 UTC 2012 - fcrozat@suse.com + +- Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix + CVE-2012-1174 (bnc#752281). + ------------------------------------------------------------------- Fri Mar 16 09:21:54 UTC 2012 - fcrozat@suse.com diff --git a/systemd.spec b/systemd.spec index d9695727..81eb8803 100644 --- a/systemd.spec +++ b/systemd.spec @@ -86,6 +86,7 @@ Patch39: correct_plymouth_paths_and_conflicts.patch # Never add any patches to this package without the upstream commit id # in the patch. Any patches added here without a very good reason to make # an exception will be silently removed with the next version update. +Patch40: 0001-util-never-follow-symlinks-in-rm_rf_children.patch %description Systemd is a system and service manager, compatible with SysV and LSB @@ -144,6 +145,7 @@ Plymouth integration for systemd %patch36 -p1 %patch38 -p1 %patch39 -p1 +%patch40 -p1 %build autoreconf -fiv