rebase to 2.4.0 to fix the following CVEs
- CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl Resolves: RHEL-186107 Resolves: RHEL-186208
This commit is contained in:
Lukáš Zaoral
parent
6c9cc9dfc2
commit
9abc8e4c42
4
.gitignore
vendored
4
.gitignore
vendored
@ -1,2 +1,2 @@
|
||||
/acl-2.[23].*.tar.gz
|
||||
/acl-2.[23].*.tar.gz.sig
|
||||
/acl-2.*.*.tar.gz
|
||||
/acl-2.*.*.tar.gz.sig
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
From 085cc4ff56857d234e80f37d0316c13eb5718696 Mon Sep 17 00:00:00 2001
|
||||
From: Kamil Dudka <kdudka@redhat.com>
|
||||
Date: Tue, 3 Jul 2018 10:46:58 +0200
|
||||
Subject: [PATCH] test/runwrapper: copy the preloaded library
|
||||
|
||||
... to a temporary directory because the original location might
|
||||
not be accessible by other users.
|
||||
---
|
||||
test/runwrapper | 20 ++++++++++++++++++--
|
||||
1 file changed, 18 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/test/runwrapper b/test/runwrapper
|
||||
index 6e0e899..de4555a 100755
|
||||
--- a/test/runwrapper
|
||||
+++ b/test/runwrapper
|
||||
@@ -1,7 +1,23 @@
|
||||
#!/bin/bash
|
||||
|
||||
-if [ -e "$PWD/.libs/libtestlookup.so" ]; then
|
||||
- export LD_PRELOAD="$PWD/.libs/libtestlookup.so"
|
||||
+src="$PWD/.libs/libtestlookup.so"
|
||||
+dst=
|
||||
+if [ -e "$src" ]; then
|
||||
+ # copy the preloaded library to a temporary directory because
|
||||
+ # the original location might not be accessible by other users
|
||||
+ tmp="$(mktemp -d)"
|
||||
+ chmod 0755 "$tmp"
|
||||
+ dst="${tmp}/libtestlookup.so"
|
||||
+ cp -L "$src" "$dst"
|
||||
+ export LD_PRELOAD="$dst"
|
||||
fi
|
||||
|
||||
"${srcdir:-${PWD}}"/test/run "$@"
|
||||
+ec="$?"
|
||||
+
|
||||
+if [ -n "$dst" ]; then
|
||||
+ # remove the temporary location
|
||||
+ rm -rf "$dst"
|
||||
+fi
|
||||
+
|
||||
+exit "$ec"
|
||||
--
|
||||
2.14.4
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
From 56abe432b65801f31277fb9a3bca0f9e31502315 Mon Sep 17 00:00:00 2001
|
||||
From: Matthias Gerstner <matthias.gerstner@suse.de>
|
||||
Date: Thu, 25 Apr 2024 12:43:49 +0200
|
||||
Subject: [PATCH] libmisc: __acl_get_uid(): fix memory wasting loop if user
|
||||
does not exist
|
||||
|
||||
I noticed that `acl_from_text()` unexpectedly returns ENOMEM for invalid
|
||||
user names. The reason for this is a missing break statement in the for
|
||||
loop in `__acl_get_uid()`, which causes the loop to act as if ERANGE was
|
||||
returned from `getpwnam_r()`, thereby exponentially increasing the
|
||||
buffer size to (in my case) multiple gigabytes, until `grow_buffer()`
|
||||
reports ENOMEM, which terminates the `__acl_get_uid()` function.
|
||||
|
||||
This is a pretty costly "no such user" lookup that can disturb a
|
||||
process's heap memory management, but can also cause a process to fail
|
||||
e.g. if it is multithreaded and other threads encounter an ENOMEM,
|
||||
before `__acl_get_uid()` frees the gigantic heap buffer and returns.
|
||||
The allocated memory isn't actually used. Therefore on Linux it should
|
||||
not affect other processes by default, due to its overcommit memory
|
||||
and lazy memory allocation strategy.
|
||||
|
||||
Fix this by properly terminating the for loop on any conditions except
|
||||
an ERANGE error being reported. The same break statement correctly
|
||||
exists in `__acl_get_gid()` already.
|
||||
|
||||
Fixes: 3737f00 ("use thread-safe getpwnam_r and getgrnam_r")
|
||||
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
|
||||
---
|
||||
libmisc/uid_gid_lookup.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/libmisc/uid_gid_lookup.c b/libmisc/uid_gid_lookup.c
|
||||
index a4f21f6..74baab4 100644
|
||||
--- a/libmisc/uid_gid_lookup.c
|
||||
+++ b/libmisc/uid_gid_lookup.c
|
||||
@@ -91,6 +91,7 @@ __acl_get_uid(const char *token, uid_t *uid_p)
|
||||
if (err == ERANGE)
|
||||
continue;
|
||||
errno = err ? err : EINVAL;
|
||||
+ break;
|
||||
}
|
||||
free(buffer);
|
||||
return result ? 0 : -1;
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@ -1,62 +0,0 @@
|
||||
From 99ed23222f315d1a6efbc240db3ff4ed04db99c6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= <lzaoral@redhat.com>
|
||||
Date: Mon, 10 Jun 2024 16:28:22 +0200
|
||||
Subject: [PATCH] tests: fix getpwnam and getgrnam
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The calls to these functions would always fail because the size of the buffer
|
||||
was smaller than the minimum (170000) specified in the test implementations
|
||||
of getgrnam_r and getpwnam_r. Use test_get*_match directly because getpwnam
|
||||
and getgrnam should never fail on ERANGE.
|
||||
|
||||
This commit fixes the following failure in the test/root/restore.test test:
|
||||
|
||||
[21] $ chown bin passwd -- failed
|
||||
chown: invalid user: ‘bin’ != ~
|
||||
|
||||
Fixes: 3737f000d3f17cd283f51eeacac21a71a3472053 ("use thread-safe getpwnam_r and getgrnam_r")
|
||||
---
|
||||
test/test_group.c | 2 +-
|
||||
test/test_passwd.c | 4 ++--
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/test/test_group.c b/test/test_group.c
|
||||
index 96dd612..42d6b07 100644
|
||||
--- a/test/test_group.c
|
||||
+++ b/test/test_group.c
|
||||
@@ -136,7 +136,7 @@ struct group *getgrnam(const char *name)
|
||||
static struct group grp;
|
||||
struct group *result;
|
||||
|
||||
- (void) getgrnam_r(name, &grp, buf, sizeof(buf), &result);
|
||||
+ (void) test_getgr_match(&grp, buf, sizeof buf, &result, match_name, name);
|
||||
return result;
|
||||
}
|
||||
|
||||
diff --git a/test/test_passwd.c b/test/test_passwd.c
|
||||
index b88ea45..ebe9dce 100644
|
||||
--- a/test/test_passwd.c
|
||||
+++ b/test/test_passwd.c
|
||||
@@ -117,7 +117,7 @@ int getpwnam_r(const char *name, struct passwd *pwd, char *buf, size_t buflen,
|
||||
*result = NULL;
|
||||
return ERANGE;
|
||||
}
|
||||
- last_buflen =- 1;
|
||||
+ last_buflen = -1;
|
||||
|
||||
return test_getpw_match(pwd, buf, buflen, result, match_name, name);
|
||||
}
|
||||
@@ -129,7 +129,7 @@ struct passwd *getpwnam(const char *name)
|
||||
static struct passwd pwd;
|
||||
struct passwd *result;
|
||||
|
||||
- (void) getpwnam_r(name, &pwd, buf, sizeof(buf), &result);
|
||||
+ (void) test_getpw_match(&pwd, buf, sizeof(buf), &result, match_name, name);
|
||||
return result;
|
||||
}
|
||||
|
||||
--
|
||||
2.45.2
|
||||
|
||||
22
acl.spec
22
acl.spec
@ -1,7 +1,7 @@
|
||||
Summary: Access control list utilities
|
||||
Name: acl
|
||||
Version: 2.3.2
|
||||
Release: 4%{?dist}
|
||||
Version: 2.4.0
|
||||
Release: 2%{?dist}
|
||||
BuildRequires: gawk
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gettext
|
||||
@ -14,18 +14,9 @@ Requires: libacl%{?_isa} = %{version}-%{release}
|
||||
Source0: https://download-mirror.savannah.gnu.org/releases/acl/acl-%{version}.tar.gz
|
||||
Source1: https://download-mirror.savannah.gnu.org/releases/acl/acl-%{version}.tar.gz.sig
|
||||
# Retreived from https://savannah.nongnu.org/people/viewgpg.php?user_id=15000
|
||||
# Source2: agruen-key.gpg
|
||||
Source2: agruen-key.gpg
|
||||
# Retrieved from https://savannah.nongnu.org/people/viewgpg.php?user_id=42032
|
||||
Source2: vapier-key.gpg
|
||||
|
||||
# avoid permission denied problem with LD_PRELOAD in the test-suite
|
||||
Patch1: 0001-acl-2.2.53-test-runwrapper.patch
|
||||
|
||||
# fix regressions introduced by the `libacl: use getpwnam_r and getgrnam_r in acl_from_text.c` patch
|
||||
# https://git.savannah.nongnu.org/cgit/acl.git/commit/?id=56abe432b65801f31277fb9a3bca0f9e31502315
|
||||
Patch2: 0001-acl-2.3.2-__acl_get_uid-fix-memory-wasting-loop.patch
|
||||
# https://lists.nongnu.org/archive/html/acl-devel/2024-06/msg00000.html
|
||||
Patch3: 0001-acl-2.3.2-tests-fix-getpwnam-and-getgrnam.patch
|
||||
# Source2: vapier-key.gpg
|
||||
|
||||
License: GPL-2.0-or-later AND LGPL-2.1-or-later
|
||||
URL: https://savannah.nongnu.org/projects/acl
|
||||
@ -132,6 +123,11 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}*
|
||||
%{_libdir}/libacl.so.*
|
||||
|
||||
%changelog
|
||||
* Wed Jul 22 2026 Lukáš Zaoral <lzaoral@redhat.com> - 2.4.0-2
|
||||
- rebase to 2.4.0 to fix the following CVEs:
|
||||
- CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions
|
||||
- CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl
|
||||
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.3.2-4
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
Resolves: RHEL-64018
|
||||
|
||||
4
sources
4
sources
@ -1,2 +1,2 @@
|
||||
SHA512 (acl-2.3.2.tar.gz) = 31aeb39958d8af5d08933dd3a89333a41025c3eb49fc461fa3c291caca51dad575ec13faeb7deba9b3c2ebf7615be7d45e2b78e50d4f83d8ec933c95931a7682
|
||||
SHA512 (acl-2.3.2.tar.gz.sig) = fcd05951bba9d99bceb6dee409ae9e186808c7106f68f7d8e31959f75e0f5b01e18b87c4c7340cb4c168734b596468c710342a7d8c5e27c9fc55f1fcb57f9625
|
||||
SHA512 (acl-2.4.0.tar.gz) = 91f82d5620ca35977e917b7f678c86136a48c2500829b31a19aee7f5be8137a7a48a049dc4d51e5f8dc3328be248756bbfee77565eff6c8a4c8fc79cb850ee0c
|
||||
SHA512 (acl-2.4.0.tar.gz.sig) = 978f71040dff604daa0d8b052b74ba44e9c9b4dcd2f8c18a798b68348acf5ee9819ec9989b69822164fc816f07cbfb982eae1502f6ba115729bb19e2dabc6a6a
|
||||
|
||||
Loading…
Reference in New Issue
Block a user