ee83ee1a57
Resolves: CVE-2026-54228 Resolves: RHEL-184766 Resolves: CVE-2026-54229 Resolves: RHEL-184771 Resolves: CVE-2026-54230 Resolves: RHEL-184774 Resolves: CVE-2026-54231 Resolves: RHEL-184781 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
40 lines
1.3 KiB
Diff
40 lines
1.3 KiB
Diff
From 8085b4f1dfbee20df6276fbb0857f04b1c87ad29 Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Fri, 7 Aug 2026 12:53:30 +0200
|
|
Subject: [PATCH 1/5] Fix race condition in ChownProblemDir
|
|
|
|
Resolves: CVE-2026-54229
|
|
|
|
A local attacker could call ChownProblemDir while post-create event handlers
|
|
are still processing a dump directory, seizing file ownership while privileged
|
|
scripts continue writing and processing those files.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
---
|
|
src/dbus/abrt-dbus.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/src/dbus/abrt-dbus.c b/src/dbus/abrt-dbus.c
|
|
index e68bce8..d152f8e 100644
|
|
--- a/src/dbus/abrt-dbus.c
|
|
+++ b/src/dbus/abrt-dbus.c
|
|
@@ -499,6 +499,15 @@ static void handle_method_call(GDBusConnection *connection,
|
|
return;
|
|
}
|
|
|
|
+ if (!problem_dump_dir_is_complete(dd))
|
|
+ {
|
|
+ g_dbus_method_invocation_return_dbus_error(invocation,
|
|
+ "org.freedesktop.problems.InvalidProblemDir",
|
|
+ _("Problem directory is being processed"));
|
|
+ dd_close(dd);
|
|
+ return;
|
|
+ }
|
|
+
|
|
int chown_res = dd_chown(dd, caller_uid);
|
|
if (chown_res != 0)
|
|
g_dbus_method_invocation_return_dbus_error(invocation,
|
|
--
|
|
2.55.0
|
|
|