From 6b701ba7b890be31c66da9b4ab1c66ebc560ca5a Mon Sep 17 00:00:00 2001 From: Jan Rybar Date: Wed, 13 May 2026 14:41:14 +0200 Subject: [PATCH] fix DoS issue introduced by previous fix Resolves: CVE-2026-4897 --- cve-2026-4897-getline-overflow.patch | 11 ++++------- polkit.spec | 6 +++++- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/cve-2026-4897-getline-overflow.patch b/cve-2026-4897-getline-overflow.patch index f3dfa98..70e0a87 100644 --- a/cve-2026-4897-getline-overflow.patch +++ b/cve-2026-4897-getline-overflow.patch @@ -8,8 +8,8 @@ Pavel Kohout, Aisle Research Signed-off-by: Jan Rybar jrybar@redhat.com --- - src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++--------- - 1 file changed, 14 insertions(+), 9 deletions(-) + src/polkitagent/polkitagenthelperprivate.c | 20 +++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c index 35bca85..7e4f94e 100644 @@ -23,7 +23,7 @@ index 35bca85..7e4f94e 100644 #include #ifndef HAVE_CLEARENV -@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv) +@@ -59,21 +60,22 @@ read_cookie (int argc, char **argv) return strdup (argv[2]); else { @@ -46,10 +46,7 @@ index 35bca85..7e4f94e 100644 { - g_strchomp (ret); - return ret; -+ /* Cookie too long - drain remaining input and reject */ -+ int c; -+ while ((c = getchar ()) != '\n' && c != EOF) -+ ; ++ /* Cookie too long - reject */ + errno = EOVERFLOW; + return NULL; } diff --git a/polkit.spec b/polkit.spec index 58edd91..5541d5d 100644 --- a/polkit.spec +++ b/polkit.spec @@ -22,7 +22,7 @@ Summary: An authorization framework Name: polkit Version: 0.117 -Release: 15%{?dist} +Release: 16%{?dist} License: LGPLv2+ URL: http://www.freedesktop.org/wiki/Software/polkit Source0: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz @@ -402,6 +402,10 @@ exit 0 %endif %changelog +* Wed May 13 2026 Jan Rybar - 0.117-16 +- fix DoS issue introduced by previous fix +- Resolves: CVE-2026-4897 + * Tue May 12 2026 Jan Rybar - 0.117-15 - CVE-2026-4897: getline() string overflow via unsanitized input - Resolves: CVE-2026-4897