aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHenrik Riomar <henrik.riomar@gmail.com>2017-05-17 21:15:07 +0200
committerNatanael Copa <ncopa@alpinelinux.org>2017-05-19 10:36:41 +0200
commitca9168c2cd05da0ee645d522cc93a8abd65e609f (patch)
tree66d320b10263e9e91f9d038c76b218352e69bd7b
parent68673d223e87a944359bd99872cacfe5d03ffd97 (diff)
downloadaports-ca9168c2cd05da0ee645d522cc93a8abd65e609f.tar.bz2
community/shadow: CVE-2017-2616 regression fix
https://lists.debian.org/debian-security-announce/2017/msg00114.html (cherry picked from commit f6afcbbc796f404b70cfea1fdef72fa5e7ed0896)
-rw-r--r--community/shadow/303-Reset-pid_child-only-if-waitpid-was-successful.patch29
-rw-r--r--community/shadow/APKBUILD6
2 files changed, 33 insertions, 2 deletions
diff --git a/community/shadow/303-Reset-pid_child-only-if-waitpid-was-successful.patch b/community/shadow/303-Reset-pid_child-only-if-waitpid-was-successful.patch
new file mode 100644
index 0000000..64aeb34
--- /dev/null
+++ b/community/shadow/303-Reset-pid_child-only-if-waitpid-was-successful.patch
@@ -0,0 +1,29 @@
+From 7d82f203eeec881c584b2fa06539b39e82985d97 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Sun, 14 May 2017 17:58:10 +0200
+Subject: [PATCH] Reset pid_child only if waitpid was successful.
+
+Do not reset the pid_child to 0 if the child process is still
+running. This else-condition can be reached with pid being -1,
+therefore explicitly test this condition.
+
+This is a regression fix for CVE-2017-2616. If su receives a
+signal like SIGTERM, it is not propagated to the child.
+
+Reported-by: Radu Duta <raduduta@gmail.com>
+Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
+---
+ src/su.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/su.c
++++ b/src/su.c
+@@ -363,7 +363,7 @@ static void prepare_pam_close_session (v
+ /* wake child when resumed */
+ kill (pid, SIGCONT);
+ stop = false;
+- } else {
++ } else if ( (pid_t)-1 != pid) {
+ pid_child = 0;
+ }
+ } while (!stop);
diff --git a/community/shadow/APKBUILD b/community/shadow/APKBUILD
index 9b5c3a4..6a7138c 100644
--- a/community/shadow/APKBUILD
+++ b/community/shadow/APKBUILD
@@ -3,7 +3,7 @@
# Maintainer: Stuart Cardall <developer@it-offshore.co.uk>
pkgname=shadow
pkgver=4.2.1
-pkgrel=7
+pkgrel=8
pkgdesc="PAM-using login and passwd utilities (usermod, useradd, ...)"
url="http://pkg-shadow.alioth.debian.org/"
arch="all"
@@ -18,6 +18,7 @@ source="http://pkg-shadow.alioth.debian.org/releases/shadow-$pkgver.tar.xz
verbose-error-when-uid-doesnt-match.patch
301-CVE-2017-2616-su-properly-clear-child-PID.patch
302-CVE-2016-6252-fix-integer-overflow.patch
+ 303-Reset-pid_child-only-if-waitpid-was-successful.patch
"
# secfixes:
# 4.2.1-r7:
@@ -92,4 +93,5 @@ sha512sums="7a14bf8e08126f0402e37b6e4c559615ced7cf829e39156d929ed05cd8813de48a77
c46760254439176babeef24d93900914092655af3a48f54385adf6ef5a3af76799fb7e96083acd27853d6ab6d7392543dbaf70bb26f164519e92f677da7851a4 cross-size-checks.patch
1b3513772a7a0294b587723213e4464cc5a1a42ae6a79e9b9f9ea20083684a21d81e362f44d87ce2e6de2daf396d8422b39019923c0b0cbb44fa4c4c24613c0c verbose-error-when-uid-doesnt-match.patch
0954920ce9307948848d8f9ca5ea5bba4db8394793ef314ab5c6770948e96071748192b52ba8c31d543fe71ce0e6e2a7f3a2a92862966a940639a19df1048634 301-CVE-2017-2616-su-properly-clear-child-PID.patch
-36f494347cb980d85ea82331ec620a949be45f5f2c400a3b13f409a8d9c932c0f822cb0baa2ee78c6f356e7bf93de51c1b0f20730e8f3af36a746a5632d19bbe 302-CVE-2016-6252-fix-integer-overflow.patch"
+36f494347cb980d85ea82331ec620a949be45f5f2c400a3b13f409a8d9c932c0f822cb0baa2ee78c6f356e7bf93de51c1b0f20730e8f3af36a746a5632d19bbe 302-CVE-2016-6252-fix-integer-overflow.patch
+e36d54759b71d48c62aefc4032e63deccafa69d22f8bae772b4c0ca135b431db9cd35a1a2a2adf5c76996e76e13ab82e1cf19bba70c6ca4414b3979a43c292c2 303-Reset-pid_child-only-if-waitpid-was-successful.patch"