aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Jirutka <jakub@jirutka.cz>2018-08-06 20:03:24 +0200
committerJakub Jirutka <jakub@jirutka.cz>2018-08-06 20:06:00 +0200
commit228f1186348553da00690d33b859187b439d94b2 (patch)
tree6b72e62ffc733e70b38d7d5f385fc98b4c891a09
parent8398d6707c886fd25c0ced7b0e0c8e3232f62295 (diff)
downloadaports-228f1186348553da00690d33b859187b439d94b2.tar.gz
aports-228f1186348553da00690d33b859187b439d94b2.tar.bz2
aports-228f1186348553da00690d33b859187b439d94b2.tar.xz
main/lxc: fix CVE-2018-6556
-rw-r--r--main/lxc/APKBUILD11
-rw-r--r--main/lxc/CVE-2018-6556.patch120
2 files changed, 129 insertions, 2 deletions
diff --git a/main/lxc/APKBUILD b/main/lxc/APKBUILD
index f7dc093bd4..84fcfc680b 100644
--- a/main/lxc/APKBUILD
+++ b/main/lxc/APKBUILD
@@ -5,7 +5,7 @@
pkgname=lxc
pkgver=2.1.1
_pkgver=${pkgver/_rc/.rc}
-pkgrel=2
+pkgrel=3
pkgdesc="Userspace interface for the Linux kernel containment features"
url="https://linuxcontainers.org/lxc/"
arch="all"
@@ -25,9 +25,15 @@ source="https://github.com/lxc/lxc/archive/lxc-$_pkgver.tar.gz
lxc.conf
download-template-tmpfs.patch
+ CVE-2018-6556.patch
"
builddir="$srcdir/lxc-lxc-$_pkgver"
+# secfixes:
+# 2.1.1-r3:
+# - CVE-2018-6556
+#
+
_tmpldir="usr/share/lxc/templates"
prepare() {
@@ -161,4 +167,5 @@ e2ffcbf55447291a8434a4f37255c3a6a119bc4116c75d205006aa2b070bf6be28535cf6107bead1
690c11a4501a093623adc3191054ed0da8dabd21ac6f8c57197d1b4a689e660d5f196978cfb9b5de5406990706a8998f0c0d181229b1688b852ded614ad97529 lxc.initd
11bd08ef450086572fd09cfa40bf9168cb8aeb1e981fc881ae8484cd0a329c3bef262bb24880e7575ff5f75ee3caef0cb240fe5d7b770bf7ff54f2c430acd177 lxc.confd
5b83b0323e58bf00bd1e124c265729499cee97559b6fe18482962e3bed50d121b4c7a09f25cbce7b1e18d4234627bc4b4581ba2060e33cd022f105b4429cef01 lxc.conf
-02fd192d137cbb5b6db6959275387d05653f41dad5a5e46ae9b53cacead8cef937733927284658d3f0b910de81f9364c7f0248db990efd88806cf3029264c214 download-template-tmpfs.patch"
+02fd192d137cbb5b6db6959275387d05653f41dad5a5e46ae9b53cacead8cef937733927284658d3f0b910de81f9364c7f0248db990efd88806cf3029264c214 download-template-tmpfs.patch
+3e45f78358fab1ff730853c26fef8694cb90d521077e5234affb960b4b89306c7592708da9aecf462074c54fdc631457e174303db175678552d558f864d9668d CVE-2018-6556.patch"
diff --git a/main/lxc/CVE-2018-6556.patch b/main/lxc/CVE-2018-6556.patch
new file mode 100644
index 0000000000..bd669cd3f6
--- /dev/null
+++ b/main/lxc/CVE-2018-6556.patch
@@ -0,0 +1,120 @@
+From d183654ec1a2cd1149bdb92601ccb7246bddb14e Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian.brauner@ubuntu.com>
+Date: Wed, 25 Jul 2018 19:56:54 +0200
+Subject: [PATCH] CVE 2018-6556: verify netns fd in lxc-user-nic
+
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+---
+ src/lxc/lxc_user_nic.c | 35 ++++++++++++++++++++++++++++++++---
+ src/lxc/utils.c | 12 ++++++++++++
+ src/lxc/utils.h | 5 +++++
+ 3 files changed, 49 insertions(+), 3 deletions(-)
+
+ADDENDUM from vdupras@gentoo.org: Original patch from Christian didn't
+include LXC_PROC_PID_FD_LEN define, but referenced it. This resulted in
+code that doesn't compile. I fetched the definition from the stable-3.0
+branch and included it to this patch. Also, this diff is regenerated
+from lxc-2.1.1 tag instead of stable-2.0 branch.
+
+Patch-Source: https://github.com/gentoo/gentoo/blob/4c6e73df9d616d5c472c276dd5bef70efea02907/app-emulation/lxc/files/lxc-2.1.1-cve-2018-6556.patch
+
+diff --git a/src/lxc/lxc_user_nic.c b/src/lxc/lxc_user_nic.c
+index 6f550f0d..09a342ac 100644
+--- a/src/lxc/lxc_user_nic.c
++++ b/src/lxc/lxc_user_nic.c
+@@ -1124,12 +1124,41 @@ int main(int argc, char *argv[])
+ exit(EXIT_FAILURE);
+ }
+ } else if (request == LXC_USERNIC_DELETE) {
+- netns_fd = open(args.pid, O_RDONLY);
++ char opath[LXC_PROC_PID_FD_LEN];
++
++ /* Open the path with O_PATH which will not trigger an actual
++ * open(). Don't report an errno to the caller to not leak
++ * information whether the path exists or not.
++ * When stracing setuid is stripped so this is not a concern
++ * either.
++ */
++ netns_fd = open(args.pid, O_PATH | O_CLOEXEC);
+ if (netns_fd < 0) {
+- usernic_error("Could not open \"%s\": %s\n", args.pid,
+- strerror(errno));
++ usernic_error("Failed to open \"%s\"\n", args.pid);
+ exit(EXIT_FAILURE);
+ }
++
++ if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) {
++ usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid);
++ close(netns_fd);
++ exit(EXIT_FAILURE);
++ }
++
++ ret = snprintf(opath, sizeof(opath), "/proc/self/fd/%d", netns_fd);
++ if (ret < 0 || (size_t)ret >= sizeof(opath)) {
++ close(netns_fd);
++ exit(EXIT_FAILURE);
++ }
++
++ /* Now get an fd that we can use in setns() calls. */
++ ret = open(opath, O_RDONLY | O_CLOEXEC);
++ if (ret < 0) {
++ usernic_error("Failed to open \"%s\": %s\n", args.pid, strerror(errno));
++ close(netns_fd);
++ exit(EXIT_FAILURE);
++ }
++ close(netns_fd);
++ netns_fd = ret;
+ }
+
+ if (!create_db_dir(LXC_USERNIC_DB)) {
+diff --git a/src/lxc/utils.c b/src/lxc/utils.c
+index e6a44a51..c2a08a9d 100644
+--- a/src/lxc/utils.c
++++ b/src/lxc/utils.c
+@@ -2380,6 +2380,18 @@ bool has_fs_type(const char *path, fs_type_magic magic_val)
+ return has_type;
+ }
+
++bool fhas_fs_type(int fd, fs_type_magic magic_val)
++{
++ int ret;
++ struct statfs sb;
++
++ ret = fstatfs(fd, &sb);
++ if (ret < 0)
++ return false;
++
++ return is_fs_type(&sb, magic_val);
++}
++
+ bool lxc_nic_exists(char *nic)
+ {
+ #define __LXC_SYS_CLASS_NET_LEN 15 + IFNAMSIZ + 1
+diff --git a/src/lxc/utils.h b/src/lxc/utils.h
+index e83ed49e..06ec74d7 100644
+--- a/src/lxc/utils.h
++++ b/src/lxc/utils.h
+@@ -46,11 +46,16 @@
+ #define __S_ISTYPE(mode, mask) (((mode)&S_IFMT) == (mask))
+ #endif
+
++#ifndef NSFS_MAGIC
++#define NSFS_MAGIC 0x6e736673
++#endif
++
+ /* Useful macros */
+ /* Maximum number for 64 bit integer is a string with 21 digits: 2^64 - 1 = 21 */
+ #define LXC_NUMSTRLEN64 21
+ #define LXC_LINELEN 4096
+ #define LXC_IDMAPLEN 4096
++#define LXC_PROC_PID_FD_LEN (6 + LXC_NUMSTRLEN64 + 4 + LXC_NUMSTRLEN64 + 1)
+
+ /* returns 1 on success, 0 if there were any failures */
+ extern int lxc_rmdir_onedev(char *path, const char *exclude);
+@@ -402,6 +407,7 @@ extern void *must_realloc(void *orig, size_t sz);
+ /* __typeof__ should be safe to use with all compilers. */
+ typedef __typeof__(((struct statfs *)NULL)->f_type) fs_type_magic;
+ extern bool has_fs_type(const char *path, fs_type_magic magic_val);
++extern bool fhas_fs_type(int fd, fs_type_magic magic_val);
+ extern bool is_fs_type(const struct statfs *fs, fs_type_magic magic_val);
+ extern bool lxc_nic_exists(char *nic);