From 60e5c5e4c37f15b664e4f26b15b3341dcb7169f0 Mon Sep 17 00:00:00 2001 From: Jan Rybar Date: Thu, 3 Jun 2021 14:05:51 +0200 Subject: [PATCH] CVE-2021-3560 mitigation Resolves: CVE-2021-3560 --- CVE-2021-3560.patch | 13 +++++++++++++ polkit.spec | 9 ++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 CVE-2021-3560.patch diff --git a/CVE-2021-3560.patch b/CVE-2021-3560.patch new file mode 100644 index 0000000..e5b2b85 --- /dev/null +++ b/CVE-2021-3560.patch @@ -0,0 +1,13 @@ +--- a/src/polkit/polkitsystembusname.c ++++ b/src/polkit/polkitsystembusname.c +@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus + while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error)) + g_main_context_iteration (tmp_context, TRUE); + ++ if (data.caught_error) ++ goto out; ++ + if (out_uid) + *out_uid = data.uid; + if (out_pid) + diff --git a/polkit.spec b/polkit.spec index 16d252a..c89dd0b 100644 --- a/polkit.spec +++ b/polkit.spec @@ -6,13 +6,16 @@ Summary: An authorization framework Name: polkit Version: 0.118 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPLv2+ URL: http://www.freedesktop.org/wiki/Software/polkit Source0: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz Source1: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz.sign +Patch1: CVE-2021-3560.patch + + BuildRequires: gcc-c++ BuildRequires: glib2-devel >= 2.30.0 BuildRequires: expat-devel @@ -175,6 +178,10 @@ exit 0 %{_libdir}/girepository-1.0/*.typelib %changelog +* Thu May 20 2021 Jan Rybar - 0.118-2 +- CVE-2021-3560 mitigation +- Resolves: CVE-2021-3560 + * Mon Apr 26 2021 Jan Rybar - 0.118-1 - rebase to 0.118