diff options
Diffstat (limited to 'meta/recipes-core/systemd/systemd/0024-journald-do-not-store-the-iovec-entry-for-process-co.patch')
-rw-r--r-- | meta/recipes-core/systemd/systemd/0024-journald-do-not-store-the-iovec-entry-for-process-co.patch | 208 |
1 files changed, 0 insertions, 208 deletions
diff --git a/meta/recipes-core/systemd/systemd/0024-journald-do-not-store-the-iovec-entry-for-process-co.patch b/meta/recipes-core/systemd/systemd/0024-journald-do-not-store-the-iovec-entry-for-process-co.patch deleted file mode 100644 index c2f78be39e..0000000000 --- a/meta/recipes-core/systemd/systemd/0024-journald-do-not-store-the-iovec-entry-for-process-co.patch +++ /dev/null | |||
@@ -1,208 +0,0 @@ | |||
1 | From 9cb07e7d82c7c4f28bbaa1478e1387e8ea3d03dd Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> | ||
3 | Date: Wed, 5 Dec 2018 18:38:39 +0100 | ||
4 | Subject: [PATCH] journald: do not store the iovec entry for process | ||
5 | commandline on stack | ||
6 | |||
7 | This fixes a crash where we would read the commandline, whose length is under | ||
8 | control of the sending program, and then crash when trying to create a stack | ||
9 | allocation for it. | ||
10 | |||
11 | CVE-2018-16864 | ||
12 | https://bugzilla.redhat.com/show_bug.cgi?id=1653855 | ||
13 | |||
14 | The message actually doesn't get written to disk, because | ||
15 | journal_file_append_entry() returns -E2BIG. | ||
16 | |||
17 | Patch backported from systemd master at | ||
18 | 084eeb865ca63887098e0945fb4e93c852b91b0f. | ||
19 | |||
20 | CVE: CVE-2018-16864 | ||
21 | Upstream-Status: Backport | ||
22 | Signed-off-by: Marcus Cooper <marcusc@axis.com> | ||
23 | --- | ||
24 | src/basic/io-util.c | 10 ++++++++++ | ||
25 | src/basic/io-util.h | 2 ++ | ||
26 | src/coredump/coredump.c | 31 +++++++++++-------------------- | ||
27 | src/journal/journald-server.c | 25 +++++++++++++++---------- | ||
28 | 4 files changed, 38 insertions(+), 30 deletions(-) | ||
29 | |||
30 | diff --git a/src/basic/io-util.c b/src/basic/io-util.c | ||
31 | index 1f64cc933b..575398fbe6 100644 | ||
32 | --- a/src/basic/io-util.c | ||
33 | +++ b/src/basic/io-util.c | ||
34 | @@ -8,6 +8,7 @@ | ||
35 | #include <unistd.h> | ||
36 | |||
37 | #include "io-util.h" | ||
38 | +#include "string-util.h" | ||
39 | #include "time-util.h" | ||
40 | |||
41 | int flush_fd(int fd) { | ||
42 | @@ -252,3 +253,12 @@ ssize_t sparse_write(int fd, const void *p, size_t sz, size_t run_length) { | ||
43 | |||
44 | return q - (const uint8_t*) p; | ||
45 | } | ||
46 | + | ||
47 | +char* set_iovec_string_field(struct iovec *iovec, size_t *n_iovec, const char *field, const char *value) { | ||
48 | + char *x; | ||
49 | + | ||
50 | + x = strappend(field, value); | ||
51 | + if (x) | ||
52 | + iovec[(*n_iovec)++] = IOVEC_MAKE_STRING(x); | ||
53 | + return x; | ||
54 | +} | ||
55 | diff --git a/src/basic/io-util.h b/src/basic/io-util.h | ||
56 | index ed189b5820..792a64ad5e 100644 | ||
57 | --- a/src/basic/io-util.h | ||
58 | +++ b/src/basic/io-util.h | ||
59 | @@ -71,3 +71,5 @@ static inline bool FILE_SIZE_VALID_OR_INFINITY(uint64_t l) { | ||
60 | #define IOVEC_MAKE(base, len) (struct iovec) IOVEC_INIT(base, len) | ||
61 | #define IOVEC_INIT_STRING(string) IOVEC_INIT((char*) string, strlen(string)) | ||
62 | #define IOVEC_MAKE_STRING(string) (struct iovec) IOVEC_INIT_STRING(string) | ||
63 | + | ||
64 | +char* set_iovec_string_field(struct iovec *iovec, size_t *n_iovec, const char *field, const char *value); | ||
65 | diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c | ||
66 | index 20a1cbdd45..18e4f61d72 100644 | ||
67 | --- a/src/coredump/coredump.c | ||
68 | +++ b/src/coredump/coredump.c | ||
69 | @@ -1053,19 +1053,10 @@ static int send_iovec(const struct iovec iovec[], size_t n_iovec, int input_fd) | ||
70 | return 0; | ||
71 | } | ||
72 | |||
73 | -static char* set_iovec_field(struct iovec *iovec, size_t *n_iovec, const char *field, const char *value) { | ||
74 | - char *x; | ||
75 | - | ||
76 | - x = strappend(field, value); | ||
77 | - if (x) | ||
78 | - iovec[(*n_iovec)++] = IOVEC_MAKE_STRING(x); | ||
79 | - return x; | ||
80 | -} | ||
81 | - | ||
82 | static char* set_iovec_field_free(struct iovec *iovec, size_t *n_iovec, const char *field, char *value) { | ||
83 | char *x; | ||
84 | |||
85 | - x = set_iovec_field(iovec, n_iovec, field, value); | ||
86 | + x = set_iovec_string_field(iovec, n_iovec, field, value); | ||
87 | free(value); | ||
88 | return x; | ||
89 | } | ||
90 | @@ -1115,36 +1106,36 @@ static int gather_pid_metadata( | ||
91 | disable_coredumps(); | ||
92 | } | ||
93 | |||
94 | - set_iovec_field(iovec, n_iovec, "COREDUMP_UNIT=", context[CONTEXT_UNIT]); | ||
95 | + set_iovec_string_field(iovec, n_iovec, "COREDUMP_UNIT=", context[CONTEXT_UNIT]); | ||
96 | } | ||
97 | |||
98 | if (cg_pid_get_user_unit(pid, &t) >= 0) | ||
99 | set_iovec_field_free(iovec, n_iovec, "COREDUMP_USER_UNIT=", t); | ||
100 | |||
101 | /* The next few are mandatory */ | ||
102 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_PID=", context[CONTEXT_PID])) | ||
103 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_PID=", context[CONTEXT_PID])) | ||
104 | return log_oom(); | ||
105 | |||
106 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_UID=", context[CONTEXT_UID])) | ||
107 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_UID=", context[CONTEXT_UID])) | ||
108 | return log_oom(); | ||
109 | |||
110 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_GID=", context[CONTEXT_GID])) | ||
111 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_GID=", context[CONTEXT_GID])) | ||
112 | return log_oom(); | ||
113 | |||
114 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_SIGNAL=", context[CONTEXT_SIGNAL])) | ||
115 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_SIGNAL=", context[CONTEXT_SIGNAL])) | ||
116 | return log_oom(); | ||
117 | |||
118 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_RLIMIT=", context[CONTEXT_RLIMIT])) | ||
119 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_RLIMIT=", context[CONTEXT_RLIMIT])) | ||
120 | return log_oom(); | ||
121 | |||
122 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_HOSTNAME=", context[CONTEXT_HOSTNAME])) | ||
123 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_HOSTNAME=", context[CONTEXT_HOSTNAME])) | ||
124 | return log_oom(); | ||
125 | |||
126 | - if (!set_iovec_field(iovec, n_iovec, "COREDUMP_COMM=", context[CONTEXT_COMM])) | ||
127 | + if (!set_iovec_string_field(iovec, n_iovec, "COREDUMP_COMM=", context[CONTEXT_COMM])) | ||
128 | return log_oom(); | ||
129 | |||
130 | if (context[CONTEXT_EXE] && | ||
131 | - !set_iovec_field(iovec, n_iovec, "COREDUMP_EXE=", context[CONTEXT_EXE])) | ||
132 | + !set_iovec_string_field(iovec, n_iovec, "COREDUMP_EXE=", context[CONTEXT_EXE])) | ||
133 | return log_oom(); | ||
134 | |||
135 | if (sd_pid_get_session(pid, &t) >= 0) | ||
136 | @@ -1212,7 +1203,7 @@ static int gather_pid_metadata( | ||
137 | iovec[(*n_iovec)++] = IOVEC_MAKE_STRING(t); | ||
138 | |||
139 | if (safe_atoi(context[CONTEXT_SIGNAL], &signo) >= 0 && SIGNAL_VALID(signo)) | ||
140 | - set_iovec_field(iovec, n_iovec, "COREDUMP_SIGNAL_NAME=SIG", signal_to_string(signo)); | ||
141 | + set_iovec_string_field(iovec, n_iovec, "COREDUMP_SIGNAL_NAME=SIG", signal_to_string(signo)); | ||
142 | |||
143 | return 0; /* we successfully acquired all metadata */ | ||
144 | } | ||
145 | diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c | ||
146 | index 4f1550ec5b..31be085c6b 100644 | ||
147 | --- a/src/journal/journald-server.c | ||
148 | +++ b/src/journal/journald-server.c | ||
149 | @@ -753,6 +753,7 @@ static void dispatch_message_real( | ||
150 | pid_t object_pid) { | ||
151 | |||
152 | char source_time[sizeof("_SOURCE_REALTIME_TIMESTAMP=") + DECIMAL_STR_MAX(usec_t)]; | ||
153 | + _cleanup_free_ char *cmdline1 = NULL, *cmdline2 = NULL; | ||
154 | uid_t journal_uid; | ||
155 | ClientContext *o; | ||
156 | |||
157 | @@ -769,20 +770,23 @@ static void dispatch_message_real( | ||
158 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, c->uid, uid_t, uid_is_valid, UID_FMT, "_UID"); | ||
159 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, c->gid, gid_t, gid_is_valid, GID_FMT, "_GID"); | ||
160 | |||
161 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->comm, "_COMM"); | ||
162 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->exe, "_EXE"); | ||
163 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->cmdline, "_CMDLINE"); | ||
164 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->capeff, "_CAP_EFFECTIVE"); | ||
165 | + IOVEC_ADD_STRING_FIELD(iovec, n, c->comm, "_COMM"); /* At most TASK_COMM_LENGTH (16 bytes) */ | ||
166 | + IOVEC_ADD_STRING_FIELD(iovec, n, c->exe, "_EXE"); /* A path, so at most PATH_MAX (4096 bytes) */ | ||
167 | |||
168 | - IOVEC_ADD_SIZED_FIELD(iovec, n, c->label, c->label_size, "_SELINUX_CONTEXT"); | ||
169 | + if (c->cmdline) | ||
170 | + /* At most _SC_ARG_MAX (2MB usually), which is too much to put on stack. | ||
171 | + * Let's use a heap allocation for this one. */ | ||
172 | + cmdline1 = set_iovec_string_field(iovec, &n, "_CMDLINE=", c->cmdline); | ||
173 | |||
174 | + IOVEC_ADD_STRING_FIELD(iovec, n, c->capeff, "_CAP_EFFECTIVE"); /* Read from /proc/.../status */ | ||
175 | + IOVEC_ADD_SIZED_FIELD(iovec, n, c->label, c->label_size, "_SELINUX_CONTEXT"); | ||
176 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, c->auditid, uint32_t, audit_session_is_valid, "%" PRIu32, "_AUDIT_SESSION"); | ||
177 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, c->loginuid, uid_t, uid_is_valid, UID_FMT, "_AUDIT_LOGINUID"); | ||
178 | |||
179 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->cgroup, "_SYSTEMD_CGROUP"); | ||
180 | + IOVEC_ADD_STRING_FIELD(iovec, n, c->cgroup, "_SYSTEMD_CGROUP"); /* A path */ | ||
181 | IOVEC_ADD_STRING_FIELD(iovec, n, c->session, "_SYSTEMD_SESSION"); | ||
182 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, c->owner_uid, uid_t, uid_is_valid, UID_FMT, "_SYSTEMD_OWNER_UID"); | ||
183 | - IOVEC_ADD_STRING_FIELD(iovec, n, c->unit, "_SYSTEMD_UNIT"); | ||
184 | + IOVEC_ADD_STRING_FIELD(iovec, n, c->unit, "_SYSTEMD_UNIT"); /* Unit names are bounded by UNIT_NAME_MAX */ | ||
185 | IOVEC_ADD_STRING_FIELD(iovec, n, c->user_unit, "_SYSTEMD_USER_UNIT"); | ||
186 | IOVEC_ADD_STRING_FIELD(iovec, n, c->slice, "_SYSTEMD_SLICE"); | ||
187 | IOVEC_ADD_STRING_FIELD(iovec, n, c->user_slice, "_SYSTEMD_USER_SLICE"); | ||
188 | @@ -803,13 +807,14 @@ static void dispatch_message_real( | ||
189 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, o->uid, uid_t, uid_is_valid, UID_FMT, "OBJECT_UID"); | ||
190 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, o->gid, gid_t, gid_is_valid, GID_FMT, "OBJECT_GID"); | ||
191 | |||
192 | + /* See above for size limits, only ->cmdline may be large, so use a heap allocation for it. */ | ||
193 | IOVEC_ADD_STRING_FIELD(iovec, n, o->comm, "OBJECT_COMM"); | ||
194 | IOVEC_ADD_STRING_FIELD(iovec, n, o->exe, "OBJECT_EXE"); | ||
195 | - IOVEC_ADD_STRING_FIELD(iovec, n, o->cmdline, "OBJECT_CMDLINE"); | ||
196 | - IOVEC_ADD_STRING_FIELD(iovec, n, o->capeff, "OBJECT_CAP_EFFECTIVE"); | ||
197 | + if (o->cmdline) | ||
198 | + cmdline2 = set_iovec_string_field(iovec, &n, "OBJECT_CMDLINE=", o->cmdline); | ||
199 | |||
200 | + IOVEC_ADD_STRING_FIELD(iovec, n, o->capeff, "OBJECT_CAP_EFFECTIVE"); | ||
201 | IOVEC_ADD_SIZED_FIELD(iovec, n, o->label, o->label_size, "OBJECT_SELINUX_CONTEXT"); | ||
202 | - | ||
203 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, o->auditid, uint32_t, audit_session_is_valid, "%" PRIu32, "OBJECT_AUDIT_SESSION"); | ||
204 | IOVEC_ADD_NUMERIC_FIELD(iovec, n, o->loginuid, uid_t, uid_is_valid, UID_FMT, "OBJECT_AUDIT_LOGINUID"); | ||
205 | |||
206 | -- | ||
207 | 2.11.0 | ||
208 | |||