From b7dacccff32294ea522df32a9391d0218e7600ea Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Mon, 20 Feb 2023 14:53:31 +0100 Subject: [PATCH] dmidecode: Do not let --dump-bin overwrite an existing file Make sure that the file passed to option --dump-bin does not already exist. In practice, it is rather unlikely that an honest user would want to overwrite an existing dump file, while this possibility could be used by a rogue user to corrupt a system file. CVE: CVE-2023-30630 Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c] Backport Changes: - Ignored changes in man/dmidecode.8 file. Signed-off-by: Jean Delvare Reviewed-by: Jerry Hoemann (cherry picked from commit 6ca381c1247c81f74e1ca4e7706f70bdda72e6f2) Signed-off-by: Dhairya Nagodra --- dmidecode.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/dmidecode.c b/dmidecode.c index b91e53b..846d9a1 100644 --- a/dmidecode.c +++ b/dmidecode.c @@ -60,6 +60,7 @@ * https://www.dmtf.org/sites/default/files/DSP0270_1.0.1.pdf */ +#include #include #include #include @@ -5097,13 +5098,22 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table, u32 table_len) { + int fd; FILE *f; - f = fopen(opt.dumpfile, "wb"); + fd = open(opt.dumpfile, O_WRONLY|O_CREAT|O_EXCL, 0666); + if (fd == -1) + { + fprintf(stderr, "%s: ", opt.dumpfile); + perror("open"); + return -1; + } + + f = fdopen(fd, "wb"); if (!f) { fprintf(stderr, "%s: ", opt.dumpfile); - perror("fopen"); + perror("fdopen"); return -1; }