ee83ee1a57
Resolves: CVE-2026-54228 Resolves: RHEL-184766 Resolves: CVE-2026-54229 Resolves: RHEL-184771 Resolves: CVE-2026-54230 Resolves: RHEL-184774 Resolves: CVE-2026-54231 Resolves: RHEL-184781 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
51 lines
1.8 KiB
Diff
51 lines
1.8 KiB
Diff
From 26e8fc810e8d498a67455a08f98a591f04f22008 Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Fri, 7 Aug 2026 12:56:32 +0200
|
|
Subject: [PATCH 2/5] Fix TOCTOU in SetElement/DeleteElement
|
|
|
|
Resolves: CVE-2026-54228
|
|
|
|
This vulnerability allows any local user to call SetElement or DeleteElement
|
|
on a dump directory that is still being processed by post-create event handlers.
|
|
This lets an attacker write arbitrary text files into (or delete files from)
|
|
a root-owned dump directory, poisoning data consumed by privileged event scripts.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
---
|
|
src/dbus/abrt-dbus.c | 19 +++++++++++++++++--
|
|
1 file changed, 17 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/dbus/abrt-dbus.c b/src/dbus/abrt-dbus.c
|
|
index d152f8e..119db3d 100644
|
|
--- a/src/dbus/abrt-dbus.c
|
|
+++ b/src/dbus/abrt-dbus.c
|
|
@@ -291,8 +291,23 @@ static struct dump_dir *open_directory_for_modification_of_element(
|
|
}
|
|
}
|
|
|
|
- return open_dump_directory(invocation, /*caller*/NULL, caller_uid, problem_id, /*Read/Write*/0,
|
|
- OPEN_AUTH_FAIL);
|
|
+ struct dump_dir *dd = open_dump_directory(invocation, /*caller*/NULL, caller_uid, problem_id,
|
|
+ /*Read/Write*/0, OPEN_AUTH_FAIL);
|
|
+ if (!dd)
|
|
+ return NULL;
|
|
+
|
|
+ if (!problem_dump_dir_is_complete(dd))
|
|
+ {
|
|
+ log_notice("Refusing modification of element '%s' in incomplete problem directory '%s'",
|
|
+ element, problem_id);
|
|
+ g_dbus_method_invocation_return_dbus_error(invocation,
|
|
+ "org.freedesktop.problems.InvalidProblemDir",
|
|
+ _("Problem directory is being processed"));
|
|
+ dd_close(dd);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ return dd;
|
|
}
|
|
|
|
|
|
--
|
|
2.55.0
|
|
|