diff --git a/SPECS/pam/CVE-2024-22365.patch b/SPECS/pam/CVE-2024-22365.patch new file mode 100644 index 00000000000..7811013728a --- /dev/null +++ b/SPECS/pam/CVE-2024-22365.patch @@ -0,0 +1,55 @@ +From 031bb5a5d0d950253b68138b498dc93be69a64cb Mon Sep 17 00:00:00 2001 +From: Matthias Gerstner +Date: Wed, 27 Dec 2023 14:01:59 +0100 +Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent + local DoS situations + +Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs +being placed in user controlled directories, causing the PAM module to +block indefinitely during `openat()`. + +Pass O_DIRECTORY to cause the `openat()` to fail if the path does not +refer to a directory. + +With this the check whether the final path element is a directory +becomes unnecessary, drop it. +--- + modules/pam_namespace/pam_namespace.c | 18 +----------------- + 1 file changed, 1 insertion(+), 17 deletions(-) + +diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c +index 2528cff86..f72d67189 100644 +--- a/modules/pam_namespace/pam_namespace.c ++++ b/modules/pam_namespace/pam_namespace.c +@@ -1201,7 +1201,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, + int dfd = AT_FDCWD; + int dfd_next; + int save_errno; +- int flags = O_RDONLY; ++ int flags = O_RDONLY | O_DIRECTORY; + int rv = -1; + struct stat st; + +@@ -1255,22 +1255,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, + rv = openat(dfd, dir, flags); + } + +- if (rv != -1) { +- if (fstat(rv, &st) != 0) { +- save_errno = errno; +- close(rv); +- rv = -1; +- errno = save_errno; +- goto error; +- } +- if (!S_ISDIR(st.st_mode)) { +- close(rv); +- errno = ENOTDIR; +- rv = -1; +- goto error; +- } +- } +- + if (flags & O_NOFOLLOW) { + /* we are inside user-owned dir - protect */ + if (protect_mount(rv, p, idata) == -1) { diff --git a/SPECS/pam/pam.spec b/SPECS/pam/pam.spec index 6df94616793..0315df781e8 100644 --- a/SPECS/pam/pam.spec +++ b/SPECS/pam/pam.spec @@ -1,7 +1,7 @@ Summary: Linux Pluggable Authentication Modules Name: pam Version: 1.5.1 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD and GPLv2+ URL: https://github.com/linux-pam/linux-pam Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz @@ -14,6 +14,8 @@ BuildRequires: audit-devel Requires: audit-libs Recommends: cracklib-dicts +Patch0: CVE-2024-22365.patch + %description The Linux PAM package contains Pluggable Authentication Modules used to enable the local system administrator to choose how applications authenticate users. @@ -36,7 +38,7 @@ This package contains libraries, header files and documentation for developing applications that use pam. %prep -%autosetup -n Linux-PAM-%{version} +%autosetup -n Linux-PAM-%{version} -p1 %build ./configure \ @@ -98,6 +100,9 @@ EOF %{_docdir}/%{name}-%{version}/* %changelog +* Fri Mar 08 2024 Saul Paredes - 1.5.1-6 +- Add patch for CVE-2024-22365 + * Tue Mar 22 2022 Andrew Phelps - 1.5.1-5 - Require audit-libs diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index e960d5285bf..c928b407f7c 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -281,10 +281,10 @@ p11-kit-debuginfo-0.24.1-1.cm2.aarch64.rpm p11-kit-devel-0.24.1-1.cm2.aarch64.rpm p11-kit-server-0.24.1-1.cm2.aarch64.rpm p11-kit-trust-0.24.1-1.cm2.aarch64.rpm -pam-1.5.1-5.cm2.aarch64.rpm -pam-debuginfo-1.5.1-5.cm2.aarch64.rpm -pam-devel-1.5.1-5.cm2.aarch64.rpm -pam-lang-1.5.1-5.cm2.aarch64.rpm +pam-1.5.1-6.cm2.aarch64.rpm +pam-debuginfo-1.5.1-6.cm2.aarch64.rpm +pam-devel-1.5.1-6.cm2.aarch64.rpm +pam-lang-1.5.1-6.cm2.aarch64.rpm patch-2.7.6-8.cm2.aarch64.rpm patch-debuginfo-2.7.6-8.cm2.aarch64.rpm pcre-8.45-2.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 4dd1b2b6eb8..dc1e46a9fca 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -287,10 +287,10 @@ p11-kit-debuginfo-0.24.1-1.cm2.x86_64.rpm p11-kit-devel-0.24.1-1.cm2.x86_64.rpm p11-kit-server-0.24.1-1.cm2.x86_64.rpm p11-kit-trust-0.24.1-1.cm2.x86_64.rpm -pam-1.5.1-5.cm2.x86_64.rpm -pam-debuginfo-1.5.1-5.cm2.x86_64.rpm -pam-devel-1.5.1-5.cm2.x86_64.rpm -pam-lang-1.5.1-5.cm2.x86_64.rpm +pam-1.5.1-6.cm2.x86_64.rpm +pam-debuginfo-1.5.1-6.cm2.x86_64.rpm +pam-devel-1.5.1-6.cm2.x86_64.rpm +pam-lang-1.5.1-6.cm2.x86_64.rpm patch-2.7.6-8.cm2.x86_64.rpm patch-debuginfo-2.7.6-8.cm2.x86_64.rpm pcre-8.45-2.cm2.x86_64.rpm