a0bcad8847
Add a backport of upstream commit 8b72ad09 which fixes
CVE-2026-58015 by validating D-Bus cookie context names
in gdbusauthmechanismsha1. The new validate_cookie_context()
function rejects contexts containing non-ASCII characters or
path traversal characters (/, \, .) before they can be used
for file path construction.
The patch was adapted for the older GLib 2.56.4 codebase:
uint8_t cast replaced with guint8, and reject_reason usage
replaced with g_warning() to avoid pulling in a separate
upstream prerequisite commit.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212254
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
75 lines
2.5 KiB
Diff
75 lines
2.5 KiB
Diff
From 2f486f021aa46d172c7c7e8eef60dc7e22ad49f2 Mon Sep 17 00:00:00 2001
|
|
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
|
Date: Mon, 20 Jul 2026 07:02:12 +0000
|
|
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
|
|
|
|
Without validation, the server could send a malicious context which
|
|
contains path traversal characters, allowing it to exfiltrate a SHA-1
|
|
hashed copy of arbitrary data from the client's file system.
|
|
|
|
To exploit this successfully would require the client to choose to
|
|
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
|
|
authentication mechanism in preference to all the other mechanisms. This
|
|
is vanishingly unlikely.
|
|
|
|
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
|
|
|
Fixes: #3931
|
|
---
|
|
gio/gdbusauthmechanismsha1.c | 35 +++++++++++++++++++++++++++++++++++
|
|
1 file changed, 35 insertions(+)
|
|
|
|
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
|
|
index 0cbaf946d..85fb5edc8 100644
|
|
--- a/gio/gdbusauthmechanismsha1.c
|
|
+++ b/gio/gdbusauthmechanismsha1.c
|
|
@@ -1130,6 +1130,34 @@ initial_response = _g_dbus_win32_get_user_sid ();
|
|
return initial_response;
|
|
}
|
|
|
|
+/* Context names must be valid ASCII, nonzero length, and may not contain the
|
|
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
|
|
+ * carriage return ("\r"), tab ("\t"), or period (".").
|
|
+ *
|
|
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
|
|
+static gboolean
|
|
+validate_cookie_context (const char *cookie_context)
|
|
+{
|
|
+ size_t i = 0;
|
|
+
|
|
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
|
|
+
|
|
+ for (i = 0; cookie_context[i] != '\0'; i++)
|
|
+ {
|
|
+ if ((guint8) cookie_context[i] >= 128 ||
|
|
+ cookie_context[i] == '/' ||
|
|
+ cookie_context[i] == '\\' ||
|
|
+ cookie_context[i] == ' ' ||
|
|
+ cookie_context[i] == '\n' ||
|
|
+ cookie_context[i] == '\r' ||
|
|
+ cookie_context[i] == '\t' ||
|
|
+ cookie_context[i] == '.')
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
+ return (i > 0);
|
|
+}
|
|
+
|
|
static void
|
|
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
|
|
const gchar *data,
|
|
@@ -1163,6 +1191,13 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
|
|
}
|
|
|
|
cookie_context = tokens[0];
|
|
+ if (!validate_cookie_context (tokens[0]))
|
|
+ {
|
|
+ g_warning ("Malformed cookie_context '%s'", tokens[0]);
|
|
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
|
|
if (*endp != '\0')
|
|
{
|