mirror of
https://gitlab.alpinelinux.org/alpine/aports.git
synced 2026-05-06 04:46:42 +02:00
main/dbus: fix CVE-2020-12049
This commit is contained in:
Leo
parent
9677580919
commit
2e63f747fe
@ -1,7 +1,7 @@
|
||||
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
|
||||
pkgname=dbus
|
||||
pkgver=1.12.16
|
||||
pkgrel=0
|
||||
pkgrel=1
|
||||
pkgdesc="Freedesktop.org message bus system"
|
||||
url="https://www.freedesktop.org/Software/dbus"
|
||||
pkggroups="messagebus"
|
||||
@ -16,11 +16,15 @@ makedepends="$depends_dev expat-dev libx11-dev autoconf automake libtool xmlto
|
||||
install="$pkgname.pre-install $pkgname.post-install"
|
||||
source="https://dbus.freedesktop.org/releases/dbus/dbus-$pkgver.tar.gz
|
||||
$pkgname.initd
|
||||
CVE-2020-12049-part1.patch
|
||||
CVE-2020-12049-part2.patch
|
||||
"
|
||||
|
||||
# secfixes:
|
||||
# 1.12.16-r1:
|
||||
# - CVE-2020-12049
|
||||
# 1.12.16-r0:
|
||||
# - CVE-2019-12749
|
||||
# - CVE-2019-12749
|
||||
|
||||
build() {
|
||||
cd "$srcdir"/$pkgname-$pkgver
|
||||
@ -68,4 +72,6 @@ x11() {
|
||||
}
|
||||
|
||||
sha512sums="27ae805170e9515a8bb0fba5f29d414edc70e3b6b28b7b65bbea47035b8eafa9ac4820cdc92645be6035f6748f8aa45679e1ffc84ba74a64859a3056d318b9bb dbus-1.12.16.tar.gz
|
||||
f3d924e0f0fdced39f0470fac362834acf9f346acdfadbcdf44f627a1b550a69d1d04b3760ff06dc86a7335824f48d3c1faa09a17071e08731705a5fb016a155 dbus.initd"
|
||||
f3d924e0f0fdced39f0470fac362834acf9f346acdfadbcdf44f627a1b550a69d1d04b3760ff06dc86a7335824f48d3c1faa09a17071e08731705a5fb016a155 dbus.initd
|
||||
553babd159d4a24876f02f024db2821afce69ada16fee9e34bd19001e18515ccf15de0493eab1acb6d9a457a4116b3760f61db082b2934d2d0a937d20dce2936 CVE-2020-12049-part1.patch
|
||||
2513c9167d4c7b95b50fdff9b4615a675873bbc2f3b9dbce2527bf1acdf6d9815435fb0e2ac73840ac1dd6c212288cdab0dd8cf85790123c2a03fb74ffd2a20e CVE-2020-12049-part2.patch"
|
||||
|
||||
75
main/dbus/CVE-2020-12049-part1.patch
Normal file
75
main/dbus/CVE-2020-12049-part1.patch
Normal file
@ -0,0 +1,75 @@
|
||||
From 272d484283883fa9ff95b69d924fff6cd34842f5 Mon Sep 17 00:00:00 2001
|
||||
From: Simon McVittie <smcv@collabora.com>
|
||||
Date: Thu, 16 Apr 2020 14:45:11 +0100
|
||||
Subject: [PATCH] sysdeps-unix: On MSG_CTRUNC, close the fds we did receive
|
||||
|
||||
MSG_CTRUNC indicates that we have received fewer fds that we should
|
||||
have done because the buffer was too small, but we were treating it
|
||||
as though it indicated that we received *no* fds. If we received any,
|
||||
we still have to make sure we close them, otherwise they will be leaked.
|
||||
|
||||
On the system bus, if an attacker can induce us to leak fds in this
|
||||
way, that's a local denial of service via resource exhaustion.
|
||||
|
||||
Reported-by: Kevin Backhouse, GitHub Security Lab
|
||||
Fixes: dbus#294
|
||||
Fixes: CVE-2020-12049
|
||||
Fixes: GHSL-2020-057
|
||||
---
|
||||
dbus/dbus-sysdeps-unix.c | 32 ++++++++++++++++++++------------
|
||||
1 file changed, 20 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/dbus/dbus-sysdeps-unix.c b/dbus/dbus-sysdeps-unix.c
|
||||
index e8cd5b33..f9dc2a6e 100644
|
||||
--- a/dbus/dbus-sysdeps-unix.c
|
||||
+++ b/dbus/dbus-sysdeps-unix.c
|
||||
@@ -435,18 +435,6 @@ _dbus_read_socket_with_unix_fds (DBusSocket fd,
|
||||
struct cmsghdr *cm;
|
||||
dbus_bool_t found = FALSE;
|
||||
|
||||
- if (m.msg_flags & MSG_CTRUNC)
|
||||
- {
|
||||
- /* Hmm, apparently the control data was truncated. The bad
|
||||
- thing is that we might have completely lost a couple of fds
|
||||
- without chance to recover them. Hence let's treat this as a
|
||||
- serious error. */
|
||||
-
|
||||
- errno = ENOSPC;
|
||||
- _dbus_string_set_length (buffer, start);
|
||||
- return -1;
|
||||
- }
|
||||
-
|
||||
for (cm = CMSG_FIRSTHDR(&m); cm; cm = CMSG_NXTHDR(&m, cm))
|
||||
if (cm->cmsg_level == SOL_SOCKET && cm->cmsg_type == SCM_RIGHTS)
|
||||
{
|
||||
@@ -501,6 +489,26 @@ _dbus_read_socket_with_unix_fds (DBusSocket fd,
|
||||
if (!found)
|
||||
*n_fds = 0;
|
||||
|
||||
+ if (m.msg_flags & MSG_CTRUNC)
|
||||
+ {
|
||||
+ unsigned int i;
|
||||
+
|
||||
+ /* Hmm, apparently the control data was truncated. The bad
|
||||
+ thing is that we might have completely lost a couple of fds
|
||||
+ without chance to recover them. Hence let's treat this as a
|
||||
+ serious error. */
|
||||
+
|
||||
+ /* We still need to close whatever fds we *did* receive,
|
||||
+ * otherwise they'll never get closed. (CVE-2020-12049) */
|
||||
+ for (i = 0; i < *n_fds; i++)
|
||||
+ close (fds[i]);
|
||||
+
|
||||
+ *n_fds = 0;
|
||||
+ errno = ENOSPC;
|
||||
+ _dbus_string_set_length (buffer, start);
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
/* put length back (doesn't actually realloc) */
|
||||
_dbus_string_set_length (buffer, start + bytes_read);
|
||||
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
||||
66
main/dbus/CVE-2020-12049-part2.patch
Normal file
66
main/dbus/CVE-2020-12049-part2.patch
Normal file
@ -0,0 +1,66 @@
|
||||
From 8bc1381819e5a845331650bfa28dacf6d2ac1748 Mon Sep 17 00:00:00 2001
|
||||
From: Simon McVittie <smcv@collabora.com>
|
||||
Date: Thu, 16 Apr 2020 14:41:48 +0100
|
||||
Subject: [PATCH] fdpass test: Assert that we don't leak file descriptors
|
||||
|
||||
This version is for the dbus-1.12 branch, and doesn't rely on dbus!153
|
||||
or dbus!120.
|
||||
|
||||
Reproduces: dbus#294
|
||||
Reproduces: CVE-2020-12049
|
||||
Reproduces: GHSL-2020-057
|
||||
Signed-off-by: Simon McVittie <smcv@collabora.com>
|
||||
---
|
||||
test/fdpass.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/test/fdpass.c b/test/fdpass.c
|
||||
index 4a3edc4e..8bad675f 100644
|
||||
--- a/test/fdpass.c
|
||||
+++ b/test/fdpass.c
|
||||
@@ -50,6 +50,14 @@
|
||||
|
||||
#include "test-utils-glib.h"
|
||||
|
||||
+#ifdef DBUS_ENABLE_EMBEDDED_TESTS
|
||||
+#include <dbus/dbus-message-internal.h>
|
||||
+#else
|
||||
+typedef struct _DBusInitialFDs DBusInitialFDs;
|
||||
+#define _dbus_check_fdleaks_enter() NULL
|
||||
+#define _dbus_check_fdleaks_leave(fds) do {} while (0)
|
||||
+#endif
|
||||
+
|
||||
/* Arbitrary; included here to avoid relying on the default */
|
||||
#define MAX_MESSAGE_UNIX_FDS 20
|
||||
/* This test won't work on Linux unless this is true. */
|
||||
@@ -92,6 +100,7 @@ typedef struct {
|
||||
GQueue messages;
|
||||
|
||||
int fd_before;
|
||||
+ DBusInitialFDs *initial_fds;
|
||||
} Fixture;
|
||||
|
||||
static void oom (const gchar *doing) G_GNUC_NORETURN;
|
||||
@@ -176,6 +185,8 @@ test_connect (Fixture *f,
|
||||
if (f->skip)
|
||||
return;
|
||||
|
||||
+ f->initial_fds = _dbus_check_fdleaks_enter ();
|
||||
+
|
||||
g_assert (f->left_server_conn == NULL);
|
||||
g_assert (f->right_server_conn == NULL);
|
||||
|
||||
@@ -871,6 +882,9 @@ teardown (Fixture *f,
|
||||
if (f->fd_before >= 0 && close (f->fd_before) < 0)
|
||||
g_error ("%s", g_strerror (errno));
|
||||
#endif
|
||||
+
|
||||
+ if (f->initial_fds != NULL)
|
||||
+ _dbus_check_fdleaks_leave (f->initial_fds);
|
||||
}
|
||||
|
||||
int
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user