ee83ee1a57
Resolves: CVE-2026-54228 Resolves: RHEL-184766 Resolves: CVE-2026-54229 Resolves: RHEL-184771 Resolves: CVE-2026-54230 Resolves: RHEL-184774 Resolves: CVE-2026-54231 Resolves: RHEL-184781 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
53 lines
2.5 KiB
Diff
53 lines
2.5 KiB
Diff
From baf3d7482378cf19a2ef0a900db7e34d54fe0ebd Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Fri, 7 Aug 2026 12:59:15 +0200
|
|
Subject: [PATCH 3/5] Fix content injection in journal log collection
|
|
|
|
Resolves: CVE-2026-54231
|
|
|
|
The post-create event handler for CCpp crashes queries the systemd
|
|
journal for log entries matching the crashed process and writes the
|
|
results to var_log_messages in the dump directory. The journalctl
|
|
query filtered only by _COMM (process name) and _UID, both of which
|
|
a local attacker can match by using prctl(PR_SET_NAME). By embedding
|
|
newline characters in syslog messages, the attacker could inject
|
|
arbitrary content into the file that root writes to the dump directory.
|
|
|
|
Add _PID filtering to the journalctl query. The dump directory already
|
|
contains a pid file with the crashed process's PID, and a local
|
|
attacker cannot predict or control the PID assigned to another user's
|
|
process. This prevents spoofed journal entries from being collected.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
---
|
|
src/plugins/ccpp_event.conf | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/plugins/ccpp_event.conf b/src/plugins/ccpp_event.conf
|
|
index f8338d2..e89e98b 100644
|
|
--- a/src/plugins/ccpp_event.conf
|
|
+++ b/src/plugins/ccpp_event.conf
|
|
@@ -28,8 +28,9 @@ EVENT=post-create type=CCpp remote!=1
|
|
executable=`cat executable` &&
|
|
base_executable=${executable##*/} &&
|
|
uid=`cat $DUMP_DIR/uid` &&
|
|
+ pid=`cat pid` &&
|
|
{
|
|
- user_log_full=`journalctl -q -b --since=-3m -n 99 _COMM="$base_executable" _UID="$uid"` &&
|
|
+ user_log_full=`journalctl -q -b --since=-3m -n 99 _COMM="$base_executable" _UID="$uid" _PID="$pid"` &&
|
|
while read line; do
|
|
if [[ $line != *" audit["* ]]; then
|
|
user_log=$user_log$line$'\n'
|
|
@@ -42,7 +43,7 @@ EVENT=post-create type=CCpp remote!=1
|
|
# Remove the line below if you don't mind sharing data from the
|
|
# system logs with unprivileged users -> bugzilla.redhat.com/1212868
|
|
false &&
|
|
- system_log_full=$log`journalctl -q -b --since=-3m --system -n 99 _COMM="$base_executable"` &&
|
|
+ system_log_full=$log`journalctl -q -b --since=-3m --system -n 99 _COMM="$base_executable" _PID="$pid"` &&
|
|
while read line; do
|
|
if [[ $line != *" audit["* ]]; then
|
|
system_log=$system_log$line$'\n'
|
|
--
|
|
2.55.0
|
|
|