diff options
author | V3n3RiX <venerix@koprulu.sector> | 2022-02-02 01:39:05 +0000 |
---|---|---|
committer | V3n3RiX <venerix@koprulu.sector> | 2022-02-02 01:39:05 +0000 |
commit | fcc5224904648a8e6eb528d7603154160a20022f (patch) | |
tree | 3bfce096b38a9cea8eed13fc70c1526c456e9abd /sys-auth/polkit/files | |
parent | 2fd57282f0262ca084e05b0f2c63fbada395d02b (diff) |
gentoo resync : 02.02.2022
Diffstat (limited to 'sys-auth/polkit/files')
-rw-r--r-- | sys-auth/polkit/files/polkit-0.117-CVE-2021-3560.patch | 29 | ||||
-rw-r--r-- | sys-auth/polkit/files/polkit-0.120-CVE-2021-4034.patch | 72 | ||||
-rw-r--r-- | sys-auth/polkit/files/polkit-0.120-meson.patch | 42 |
3 files changed, 143 insertions, 0 deletions
diff --git a/sys-auth/polkit/files/polkit-0.117-CVE-2021-3560.patch b/sys-auth/polkit/files/polkit-0.117-CVE-2021-3560.patch new file mode 100644 index 000000000000..9c3ce20cf574 --- /dev/null +++ b/sys-auth/polkit/files/polkit-0.117-CVE-2021-3560.patch @@ -0,0 +1,29 @@ +https://bugs.gentoo.org/794052 + +From a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Mon Sep 17 00:00:00 2001 +From: Jan Rybar <jrybar@redhat.com> +Date: Wed, 2 Jun 2021 15:43:38 +0200 +Subject: [PATCH] GHSL-2021-074: authentication bypass vulnerability in polkit + +initial values returned if error caught +--- + src/polkit/polkitsystembusname.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c +index 8daa12c..8ed1363 100644 +--- a/src/polkit/polkitsystembusname.c ++++ b/src/polkit/polkitsystembusname.c +@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus + while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error)) + g_main_context_iteration (tmp_context, TRUE); + ++ if (data.caught_error) ++ goto out; ++ + if (out_uid) + *out_uid = data.uid; + if (out_pid) +-- +GitLab + diff --git a/sys-auth/polkit/files/polkit-0.120-CVE-2021-4034.patch b/sys-auth/polkit/files/polkit-0.120-CVE-2021-4034.patch new file mode 100644 index 000000000000..22bb71d14204 --- /dev/null +++ b/sys-auth/polkit/files/polkit-0.120-CVE-2021-4034.patch @@ -0,0 +1,72 @@ +https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt +https://bugs.gentoo.org/832057 +https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch + +From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001 +From: Jan Rybar <jrybar@redhat.com> +Date: Tue, 25 Jan 2022 17:21:46 +0000 +Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034) + +--- a/src/programs/pkcheck.c ++++ b/src/programs/pkcheck.c +@@ -363,6 +363,11 @@ main (int argc, char *argv[]) + local_agent_handle = NULL; + ret = 126; + ++ if (argc < 1) ++ { ++ exit(126); ++ } ++ + /* Disable remote file access from GIO. */ + setenv ("GIO_USE_VFS", "local", 1); + +--- a/src/programs/pkexec.c ++++ b/src/programs/pkexec.c +@@ -488,6 +488,15 @@ main (int argc, char *argv[]) + pid_t pid_of_caller; + gpointer local_agent_handle; + ++ ++ /* ++ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out. ++ */ ++ if (argc<1) ++ { ++ exit(127); ++ } ++ + ret = 127; + authority = NULL; + subject = NULL; +@@ -614,10 +623,10 @@ main (int argc, char *argv[]) + + path = g_strdup (pwstruct.pw_shell); + if (!path) +- { ++ { + g_printerr ("No shell configured or error retrieving pw_shell\n"); + goto out; +- } ++ } + /* If you change this, be sure to change the if (!command_line) + case below too */ + command_line = g_strdup (path); +@@ -636,7 +645,15 @@ main (int argc, char *argv[]) + goto out; + } + g_free (path); +- argv[n] = path = s; ++ path = s; ++ ++ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated. ++ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination ++ */ ++ if (argv[n] != NULL) ++ { ++ argv[n] = path; ++ } + } + if (access (path, F_OK) != 0) + { +GitLab diff --git a/sys-auth/polkit/files/polkit-0.120-meson.patch b/sys-auth/polkit/files/polkit-0.120-meson.patch new file mode 100644 index 000000000000..5e144688d374 --- /dev/null +++ b/sys-auth/polkit/files/polkit-0.120-meson.patch @@ -0,0 +1,42 @@ +From e7f3d9e8341df64e2abc3910dafb1113a84bff07 Mon Sep 17 00:00:00 2001 +From: Simon McVittie <smcv@debian.org> +Date: Mon, 25 Oct 2021 20:21:27 +0100 +Subject: [PATCH] Don't pass positional parameters to i18n.merge_file + +These were always ignored, and Meson 0.60.0 disallowed them. + +Resolves: https://gitlab.freedesktop.org/polkit/polkit/-/issues/160 +Reference: https://github.com/mesonbuild/meson/pull/9445 +Signed-off-by: Simon McVittie <smcv@debian.org> +--- + actions/meson.build | 1 - + src/examples/meson.build | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/actions/meson.build b/actions/meson.build +index 2abaaf3..1e3f370 100644 +--- a/actions/meson.build ++++ b/actions/meson.build +@@ -1,7 +1,6 @@ + policy = 'org.freedesktop.policykit.policy' + + i18n.merge_file( +- policy, + input: policy + '.in', + output: '@BASENAME@', + po_dir: po_dir, +diff --git a/src/examples/meson.build b/src/examples/meson.build +index c6305ab..8c18de5 100644 +--- a/src/examples/meson.build ++++ b/src/examples/meson.build +@@ -1,7 +1,6 @@ + policy = 'org.freedesktop.policykit.examples.pkexec.policy' + + i18n.merge_file( +- policy, + input: policy + '.in', + output: '@BASENAME@', + po_dir: po_dir, +-- +GitLab + |