Yang Zhang created a merge request: https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1392
Project:Branches: Chloe/rtems:fix-fcntl-uaf-on-dup-error to rtems/rtos/rtems:main Author: Yang Zhang ## Summary In duplicate_iop() and duplicate2_iop(), when the open handler (open_h) returns a non-zero status (e.g. positive errno), the open descriptor was freed via rtems_libio_free(), but the non-zero status value was returned directly to fcntl()/dup2(). If open_h returned a positive errno value, fcntl()/dup2() would return it as a positive file descriptor even though the descriptor had been freed, leading to Use-After-Free (UAF) vulnerabilities. Fix this by setting errno if rv \> 0 and ensuring rv = -1 is returned on error, satisfying POSIX compliance. ## Generative AI None -- View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1392 You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/5-el1dl00b1u5lxrolc8vhk4zsi-1d/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help
_______________________________________________ bugs mailing list [email protected] http://lists.rtems.org/mailman/listinfo/bugs
