From f93bd4879d17c93f2e8664bfee648c4c0dedb5a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89rico=20Nogueira?= Date: Fri, 11 Jun 2021 00:21:23 -0300 Subject: [PATCH] polkit: fix CVE-2021-3560. --- ...13affe0fa53ff618e07aa8f57f4c0e3b9b81.patch | 27 +++++++++++++++++++ srcpkgs/polkit/template | 2 +- 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/polkit/patches/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81.patch diff --git a/srcpkgs/polkit/patches/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81.patch b/srcpkgs/polkit/patches/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81.patch new file mode 100644 index 00000000000..b3f15472d7d --- /dev/null +++ b/srcpkgs/polkit/patches/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81.patch @@ -0,0 +1,27 @@ +From a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Mon Sep 17 00:00:00 2001 +From: Jan Rybar +Date: Wed, 2 Jun 2021 15:43:38 +0200 +Subject: [PATCH] GHSL-2021-074: authentication bypass vulnerability in polkit + +initial values returned if error caught +--- + src/polkit/polkitsystembusname.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c +index 8daa12c..8ed1363 100644 +--- src/polkit/polkitsystembusname.c ++++ src/polkit/polkitsystembusname.c +@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus + while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error)) + g_main_context_iteration (tmp_context, TRUE); + ++ if (data.caught_error) ++ goto out; ++ + if (out_uid) + *out_uid = data.uid; + if (out_pid) +-- +GitLab + diff --git a/srcpkgs/polkit/template b/srcpkgs/polkit/template index 13a1c10c1d2..01d31d7dc6a 100644 --- a/srcpkgs/polkit/template +++ b/srcpkgs/polkit/template @@ -1,7 +1,7 @@ # Template file for 'polkit' pkgname=polkit version=0.118 -revision=1 +revision=2 build_style=gnu-configure build_helper=gir configure_args="$(vopt_enable gir introspection) -disable-static