5cb1f83ea7
Add patch for CVE-2026-58015 which validates the cookie context
in the GDBus SHA-1 authentication mechanism. Without validation,
a malicious D-Bus server could send a crafted context containing
path traversal characters, allowing exfiltration of SHA-1 hashed
copies of arbitrary data from the client's file system. The patch
also includes an added `#include <stdint.h>` needed for the
`uint8_t` type used in the validation function on the older
glib2 2.68.4 codebase.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212262
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
88 lines
2.9 KiB
Diff
88 lines
2.9 KiB
Diff
From c681e6087c2dfe7788319672ca54c11f59ee8542 Mon Sep 17 00:00:00 2001
|
||
From: Philip Withnall <pwithnall@gnome.org>
|
||
Date: Tue, 28 Apr 2026 15:47:30 +0100
|
||
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
Without validation, the server could send a malicious context which
|
||
contains path traversal characters, allowing it to exfiltrate a SHA-1
|
||
hashed copy of arbitrary data from the client’s file system.
|
||
|
||
To exploit this successfully would require the client to choose to
|
||
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
|
||
authentication mechanism in preference to all the other mechanisms. This
|
||
is vanishingly unlikely.
|
||
|
||
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
||
|
||
Fixes: #3931
|
||
---
|
||
gio/gdbusauthmechanismsha1.c | 38 ++++++++++++++++++++++++++++++++++++
|
||
1 file changed, 38 insertions(+)
|
||
|
||
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
|
||
index 095a6663e..4103d950e 100644
|
||
--- a/gio/gdbusauthmechanismsha1.c
|
||
+++ b/gio/gdbusauthmechanismsha1.c
|
||
@@ -44,6 +44,8 @@
|
||
|
||
#include "glibintl.h"
|
||
|
||
+#include <stdint.h>
|
||
+
|
||
/*
|
||
* Arbitrary timeouts for keys in the keyring.
|
||
* For interoperability, these match the reference implementation, libdbus.
|
||
@@ -1160,6 +1162,34 @@ mechanism_client_initiate (GDBusAuthMechanism *mechanism,
|
||
return initial_response;
|
||
}
|
||
|
||
+/* Context names must be valid ASCII, nonzero length, and may not contain the
|
||
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
|
||
+ * carriage return ("\r"), tab ("\t"), or period (".").
|
||
+ *
|
||
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
|
||
+static gboolean
|
||
+validate_cookie_context (const char *cookie_context)
|
||
+{
|
||
+ size_t i = 0;
|
||
+
|
||
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
|
||
+
|
||
+ for (i = 0; cookie_context[i] != '\0'; i++)
|
||
+ {
|
||
+ if ((uint8_t) cookie_context[i] >= 128 ||
|
||
+ cookie_context[i] == '/' ||
|
||
+ cookie_context[i] == '\\' ||
|
||
+ cookie_context[i] == ' ' ||
|
||
+ cookie_context[i] == '\n' ||
|
||
+ cookie_context[i] == '\r' ||
|
||
+ cookie_context[i] == '\t' ||
|
||
+ cookie_context[i] == '.')
|
||
+ return FALSE;
|
||
+ }
|
||
+
|
||
+ return (i > 0);
|
||
+}
|
||
+
|
||
static void
|
||
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
|
||
const gchar *data,
|
||
@@ -1194,6 +1224,14 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
|
||
}
|
||
|
||
cookie_context = tokens[0];
|
||
+ if (!validate_cookie_context (tokens[0]))
|
||
+ {
|
||
+ g_free (m->priv->reject_reason);
|
||
+ m->priv->reject_reason = g_strdup_printf ("Malformed cookie_context '%s'", tokens[0]);
|
||
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
|
||
+ goto out;
|
||
+ }
|
||
+
|
||
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
|
||
if (*endp != '\0')
|
||
{
|