2021-06-11 05:21:23 +02:00
|
|
|
From a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Mon Sep 17 00:00:00 2001
|
|
|
|
|
From: Jan Rybar <jrybar@redhat.com>
|
|
|
|
|
Date: Wed, 2 Jun 2021 15:43:38 +0200
|
|
|
|
|
Subject: [PATCH] GHSL-2021-074: authentication bypass vulnerability in polkit
|
|
|
|
|
|
|
|
|
|
initial values returned if error caught
|
|
|
|
|
---
|
|
|
|
|
src/polkit/polkitsystembusname.c | 3 +++
|
|
|
|
|
1 file changed, 3 insertions(+)
|
|
|
|
|
|
|
|
|
|
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
|
|
|
|
|
index 8daa12c..8ed1363 100644
|
srcpkgs/p*: convert patches to -Np1
* par is kept at -Np0
```sh
git grep -l '^patch_args=-Np0' "srcpkgs/$1*/template" |
while read template; do
for p in ${template%/template}/patches/*; do
sed -i '
\,^[+-][+-][+-] /dev/null,b
/^[*-]\+ [0-9]\+\(,[0-9]\+\)\? [*-]\+$/b
s,^[*][*][*] ,&a/,
/^--- /{
s,\(^--- \)\(./\)*,\1a/,
s,[.-][Oo][Rr][Ii][Gg]\([ /]\),\1,
s/[.-][Oo][Rr][Ii][Gg]$//
s/[.]patched[.]\([^.]\)/.\1/
h
}
/^+++ -/{
g
s/^--- a/+++ b/
b
}
s,\(^+++ \)\(./\)*,\1b/,
' "$p"
done
sed -i '/^patch_args=/d' $template
done
```
2021-06-19 05:03:21 +02:00
|
|
|
--- a/src/polkit/polkitsystembusname.c
|
|
|
|
|
+++ b/src/polkit/polkitsystembusname.c
|
2021-06-11 05:21:23 +02:00
|
|
|
@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
|
|
|
|
|
while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
|
|
|
|
|
g_main_context_iteration (tmp_context, TRUE);
|
|
|
|
|
|
|
|
|
|
+ if (data.caught_error)
|
|
|
|
|
+ goto out;
|
|
|
|
|
+
|
|
|
|
|
if (out_uid)
|
|
|
|
|
*out_uid = data.uid;
|
|
|
|
|
if (out_pid)
|
|
|
|
|
--
|
|
|
|
|
GitLab
|
|
|
|
|
|
