134 lines
4.5 KiB
Diff
134 lines
4.5 KiB
Diff
From 68384f6ab79233817b5bf3370f0a46ee20a7f7e8 Mon Sep 17 00:00:00 2001
|
|
From: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
Date: Wed, 1 Oct 2025 10:49:34 +0200
|
|
Subject: [PATCH] SDMP: Service Discovery Plugin
|
|
|
|
RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
RH-MergeRequest: 56: SDMP: Service Discovery Plugin
|
|
RH-Jira: RHEL-117388
|
|
RH-Acked-by: roverflow <None>
|
|
RH-Acked-by: Maxim Levitsky <None>
|
|
RH-Acked-by: Ani Sinha <anisinha@redhat.com>
|
|
RH-Commit: [1/1] b8e63c398b7615bbbd86ae3b4539717e4fff74b1
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-117388
|
|
CVE: CVE-2025-41244
|
|
|
|
commit 7ed196cf01f8acd09011815a605b6733894b8aab
|
|
Author: Kruti Pendharkar <kp025370@broadcom.com>
|
|
Date: Mon Sep 29 01:02:40 2025 -0700
|
|
|
|
Address CVE-2025-41244
|
|
- Disable (default) the execution of the SDMP get-versions.sh script.
|
|
|
|
With the Linux SDMP get-versions.sh script disabled, version information
|
|
of installed services will not be made available to VMware Aria
|
|
|
|
RHEL-only: used
|
|
https://github.com/vmware/open-vm-tools/blob/CVE-2025-41244.patch/CVE-2025-41244-1230-1235-SDMP.patch
|
|
patch for 12.3 version.
|
|
|
|
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
---
|
|
.../serviceDiscovery/serviceDiscovery.c | 34 ++++++++++++++++---
|
|
1 file changed, 30 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
|
|
index 103cf14e..2f65294b 100644
|
|
--- a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
|
|
+++ b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
|
|
@@ -115,6 +115,12 @@ static gchar* scriptInstallDir = NULL;
|
|
*/
|
|
#define SERVICE_DISCOVERY_RPC_WAIT_TIME 100
|
|
|
|
+/*
|
|
+ * Defines the configuration to enable/disable version obtaining logic
|
|
+ */
|
|
+#define CONFNAME_SERVICEDISCOVERY_VERSION_CHECK "version-check-enabled"
|
|
+#define SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK FALSE
|
|
+
|
|
/*
|
|
* Defines the configuration to cache data in gdp plugin
|
|
*/
|
|
@@ -1239,23 +1245,27 @@ ServiceDiscoveryServerShutdown(gpointer src,
|
|
*
|
|
* Construct final paths of the scripts that will be used for execution.
|
|
*
|
|
+ * @param[in] versionCheckEnabled TRUE to include the SERVICE_DISCOVERY_KEY_VERSIONS
|
|
+ * entry; FALSE to skip it (derived from config).
|
|
+ *
|
|
*****************************************************************************
|
|
*/
|
|
|
|
static void
|
|
-ConstructScriptPaths(void)
|
|
+ConstructScriptPaths(Bool versionCheckEnabled)
|
|
{
|
|
int i;
|
|
#if !defined(OPEN_VM_TOOLS)
|
|
gchar *toolsInstallDir;
|
|
#endif
|
|
+ int insertIndex = 0;
|
|
|
|
if (gFullPaths != NULL) {
|
|
return;
|
|
}
|
|
|
|
gFullPaths = g_array_sized_new(FALSE, TRUE, sizeof(KeyNameValue),
|
|
- ARRAYSIZE(gKeyScripts));
|
|
+ ARRAYSIZE(gKeyScripts) - (versionCheckEnabled ? 0u : 1u));
|
|
if (scriptInstallDir == NULL) {
|
|
#if defined(OPEN_VM_TOOLS)
|
|
scriptInstallDir = Util_SafeStrdup(VMTOOLS_SERVICE_DISCOVERY_SCRIPTS);
|
|
@@ -1267,6 +1277,15 @@ ConstructScriptPaths(void)
|
|
#endif
|
|
}
|
|
for (i = 0; i < ARRAYSIZE(gKeyScripts); ++i) {
|
|
+ /*
|
|
+ * Skip adding if:
|
|
+ * 1. Version check is disabled, AND
|
|
+ * 2. The keyName matches SERVICE_DISCOVERY_KEY_VERSIONS
|
|
+ */
|
|
+ if (!versionCheckEnabled &&
|
|
+ g_strcmp0(gKeyScripts[i].keyName, SERVICE_DISCOVERY_KEY_VERSIONS) == 0) {
|
|
+ continue;
|
|
+ }
|
|
KeyNameValue tmp;
|
|
tmp.keyName = g_strdup_printf("%s", gKeyScripts[i].keyName);
|
|
#if defined(_WIN32)
|
|
@@ -1274,7 +1293,8 @@ ConstructScriptPaths(void)
|
|
#else
|
|
tmp.val = g_strdup_printf("%s%s%s", scriptInstallDir, DIRSEPS, gKeyScripts[i].val);
|
|
#endif
|
|
- g_array_insert_val(gFullPaths, i, tmp);
|
|
+ g_array_insert_val(gFullPaths, insertIndex, tmp);
|
|
+ insertIndex++;
|
|
}
|
|
}
|
|
|
|
@@ -1340,14 +1360,20 @@ ToolsOnLoad(ToolsAppCtx *ctx)
|
|
}
|
|
};
|
|
gboolean disabled;
|
|
+ Bool versionCheckEnabled;
|
|
|
|
regData.regs = VMTools_WrapArray(regs,
|
|
sizeof *regs,
|
|
ARRAYSIZE(regs));
|
|
+ versionCheckEnabled = VMTools_ConfigGetBoolean(
|
|
+ ctx->config,
|
|
+ CONFGROUPNAME_SERVICEDISCOVERY,
|
|
+ CONFNAME_SERVICEDISCOVERY_VERSION_CHECK,
|
|
+ SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK);
|
|
/*
|
|
* Append scripts execution command line
|
|
*/
|
|
- ConstructScriptPaths();
|
|
+ ConstructScriptPaths(versionCheckEnabled);
|
|
|
|
disabled =
|
|
VMTools_ConfigGetBoolean(ctx->config,
|
|
--
|
|
2.47.3
|
|
|