subject:"\[oe\] \[meta\-oe\]\[dunfell\]\[PATCH\] CVE\-2021\-3466\: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector"

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

2022-01-27 Thread Jeremy Puhlman


Had an odd brain fart for some reason.

On 1/26/2022 10:27 PM, Ranjitsinh Rathod wrote:

Seems like the subject line is wrongly saying CVE-2021-3466 CVE.


Thanks,

Best Regards,

*Ranjitsinh Rathod*
Technical Leader |  | KPIT Technologies Ltd.
Cellphone: +91-84606 92403
*^__
*KPIT <http://www.kpit.com/>|Follow us on LinkedIn 
<http://www.kpit.com/linkedin>


<https://www.kpit.com/TheNewBrand>



*From:* openembedded-devel@lists.openembedded.org 
 on behalf of Jeremy 
Puhlman via lists.openembedded.org 


*Sent:* Thursday, January 27, 2022 5:44 AM
*To:* openembedded-devel@lists.openembedded.org 


*Cc:* Jeremy A. Puhlman 
*Subject:* [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local 
privilege escalation in pkexec due to incorrect handling of argument 
vector
Caution: This email originated from outside of the KPIT. Do not click 
links or open attachments unless you recognize the sender and know the 
content is safe.


Upstream-Status: Backport
CVE: CVE-2021-3466
Signed-off-by: Jeremy A. Puhlman 
---
 .../polkit/files/CVE-2021-4034.patch  | 71 +++
 .../recipes-extended/polkit/polkit_0.116.bb   |  1 +
 2 files changed, 72 insertions(+)
 create mode 100644 
meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch


diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch 
b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch

new file mode 100644
index 0..294ada961
--- /dev/null
+++ b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
@@ -0,0 +1,71 @@
+From ed8b418f1341cf7fc576f6b17de5c6dd4017e034 Mon Sep 17 00:00:00 2001
+From: "Jeremy A. Puhlman" 
+Date: Thu, 27 Jan 2022 00:01:27 +
+Subject: [PATCH] CVE-2021-4034: Local privilege escalation in pkexec 
due to

+ incorrect handling of argument vector
+
+Upstream-Status: Backport 
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fpolkit%2Fpolkit%2F-%2Fcommit%2Fa2bf5c9c83b6ae46cbd5c779d3055bff81ded683data=04%7C01%7Cranjitsinh.rathod%40kpit.com%7C45f46f1f615a4eb760cf08d9e12a0005%7C3539451eb46e4a26a242ff61502855c7%7C0%7C0%7C637788392834981462%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000sdata=6gOaS0OVJ%2B3GwhS8HtF4DXXiZOsxIYmbuSjsz4LgJME%3Dreserved=0 
<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fpolkit%2Fpolkit%2F-%2Fcommit%2Fa2bf5c9c83b6ae46cbd5c779d3055bff81ded683data=04%7C01%7Cranjitsinh.rathod%40kpit.com%7C45f46f1f615a4eb760cf08d9e12a0005%7C3539451eb46e4a26a242ff61502855c7%7C0%7C0%7C637788392834981462%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000sdata=6gOaS0OVJ%2B3GwhS8HtF4DXXiZOsxIYmbuSjsz4LgJME%3Dreserved=0>

+---
+ src/programs/pkcheck.c |  6 ++
+ src/programs/pkexec.c  | 21 -
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..aff4f60 100644
+--- a/src/programs/pkcheck.c
 b/src/programs/pkcheck.c
+@@ -363,6 +363,12 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+
++  if (argc < 1)
++    {
++  help();
++  exit(1);
++    }
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..3ff4c58 100644
+--- a/src/programs/pkexec.c
 b/src/programs/pkexec.c
+@@ -488,6 +488,17 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+
++
++  /*
++   * If 'pkexec' is called wrong, just show help and bail out.
++   */
++  if (argc<1)
++    {
++  clearenv();
++  usage(argc, argv);
++  exit(1);
++    }
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -636,7 +647,15 @@ main (int argc, char *argv[])
+   goto out;
+ }
+   g_free (path);
+-  argv[n] = path = s;
++  path = s;
++
++  /* argc<2 and pkexec runs just shell, argv is guaranteed to be 
null-terminated.
++   * /-less shell shouldn't happen, but let's be defensive and 
don't write to null-termination

++   */
++  if (argv[n] != NULL)
++  {
++    argv[n] = path;
++  }
+ }
+   if (access (path, F_OK) != 0)
+ {
+--
+2.26.2
+
diff --git a/meta-oe/recipes-extended/polkit/polkit_0.116.bb 
b/meta-oe/recipes-extended/polkit/polkit_0.116.bb

index ad1973b13..77288b008 100644
--- a/meta-oe/recipes-extended/polkit/polkit_0.116.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
@@ -25,6 +25,7 @@ PAM_SRC_URI = "file://polkit-1_pam.patch"
 SRC_URI = 
"https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freedesktop.org%2Fsoftware%2Fpolkit%2Freleases%2Fpolkit-%24

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

2022-01-27 Thread Armin Kuster




On 1/26/22 16:14, Jeremy Puhlman wrote:

Upstream-Status: Backport
CVE: CVE-2021-3466
Signed-off-by: Jeremy A. Puhlman 
---
  .../polkit/files/CVE-2021-4034.patch  | 71 +++
  .../recipes-extended/polkit/polkit_0.116.bb   |  1 +
  2 files changed, 72 insertions(+)
  create mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch

diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch 
b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
new file mode 100644
index 0..294ada961
--- /dev/null
+++ b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
@@ -0,0 +1,71 @@
+From ed8b418f1341cf7fc576f6b17de5c6dd4017e034 Mon Sep 17 00:00:00 2001
+From: "Jeremy A. Puhlman" 
+Date: Thu, 27 Jan 2022 00:01:27 +
+Subject: [PATCH] CVE-2021-4034: Local privilege escalation in pkexec due to
+ incorrect handling of argument vector
+
+Upstream-Status: Backport 
https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683

The patch itself needs to contain this additional information. Please add:

CVE: CVE-2021-
Signed-off-by: Jeremy A. Puhlman 


+---
+ src/programs/pkcheck.c |  6 ++
+ src/programs/pkexec.c  | 21 -
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..aff4f60 100644
+--- a/src/programs/pkcheck.c
 b/src/programs/pkcheck.c
+@@ -363,6 +363,12 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+
++  if (argc < 1)
++{
++  help();
++  exit(1);
++}
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..3ff4c58 100644
+--- a/src/programs/pkexec.c
 b/src/programs/pkexec.c
+@@ -488,6 +488,17 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+
++
++  /*
++   * If 'pkexec' is called wrong, just show help and bail out.
++   */
++  if (argc<1)
++{
++  clearenv();
++  usage(argc, argv);
++  exit(1);
++}
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -636,7 +647,15 @@ main (int argc, char *argv[])
+   goto out;
+ }
+   g_free (path);
+-  argv[n] = path = s;
++  path = s;
++
++  /* argc<2 and pkexec runs just shell, argv is guaranteed to be 
null-terminated.
++   * /-less shell shouldn't happen, but let's be defensive and don't 
write to null-termination
++   */
++  if (argv[n] != NULL)
++  {
++argv[n] = path;
++  }
+ }
+   if (access (path, F_OK) != 0)
+ {
+--
+2.26.2
+
diff --git a/meta-oe/recipes-extended/polkit/polkit_0.116.bb 
b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
index ad1973b13..77288b008 100644
--- a/meta-oe/recipes-extended/polkit/polkit_0.116.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
@@ -25,6 +25,7 @@ PAM_SRC_URI = "file://polkit-1_pam.patch"
  SRC_URI = 
"http://www.freedesktop.org/software/polkit/releases/polkit-${PV}.tar.gz \
 ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', 
'', d)} \
 file://0003-make-netgroup-support-optional.patch \
+   file://CVE-2021-4034.patch \
 "
  SRC_URI[md5sum] = "4b37258583393e83069a0e2e89c0162a"
  SRC_URI[sha256sum] = 
"88170c9e711e8db305a12fdb8234fac5706c61969b94e084d0f117d8ec5d34b1"






-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#95122): 
https://lists.openembedded.org/g/openembedded-devel/message/95122
Mute This Topic: https://lists.openembedded.org/mt/88710808/21656
Group Owner: openembedded-devel+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

2022-01-26 Thread Ranjitsinh Rathod via lists.openembedded.org

Seems like the subject line is wrongly saying CVE-2021-3466 CVE.


Thanks,

Best Regards,

Ranjitsinh Rathod
Technical Leader |  | KPIT Technologies Ltd.
Cellphone: +91-84606 92403
__
KPIT<http://www.kpit.com/> | Follow us on LinkedIn<http://www.kpit.com/linkedin>

[cid:a7169fa9-b9a2-4286-918a-b59f14fcc626]<https://www.kpit.com/TheNewBrand>


From: openembedded-devel@lists.openembedded.org 
 on behalf of Jeremy Puhlman via 
lists.openembedded.org 
Sent: Thursday, January 27, 2022 5:44 AM
To: openembedded-devel@lists.openembedded.org 

Cc: Jeremy A. Puhlman 
Subject: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege 
escalation in pkexec due to incorrect handling of argument vector

Caution: This email originated from outside of the KPIT. Do not click links or 
open attachments unless you recognize the sender and know the content is safe.

Upstream-Status: Backport
CVE: CVE-2021-3466
Signed-off-by: Jeremy A. Puhlman 
---
 .../polkit/files/CVE-2021-4034.patch  | 71 +++
 .../recipes-extended/polkit/polkit_0.116.bb   |  1 +
 2 files changed, 72 insertions(+)
 create mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch

diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch 
b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
new file mode 100644
index 0..294ada961
--- /dev/null
+++ b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
@@ -0,0 +1,71 @@
+From ed8b418f1341cf7fc576f6b17de5c6dd4017e034 Mon Sep 17 00:00:00 2001
+From: "Jeremy A. Puhlman" 
+Date: Thu, 27 Jan 2022 00:01:27 +
+Subject: [PATCH] CVE-2021-4034: Local privilege escalation in pkexec due to
+ incorrect handling of argument vector
+
+Upstream-Status: Backport 
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fpolkit%2Fpolkit%2F-%2Fcommit%2Fa2bf5c9c83b6ae46cbd5c779d3055bff81ded683data=04%7C01%7Cranjitsinh.rathod%40kpit.com%7C45f46f1f615a4eb760cf08d9e12a0005%7C3539451eb46e4a26a242ff61502855c7%7C0%7C0%7C637788392834981462%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000sdata=6gOaS0OVJ%2B3GwhS8HtF4DXXiZOsxIYmbuSjsz4LgJME%3Dreserved=0
+---
+ src/programs/pkcheck.c |  6 ++
+ src/programs/pkexec.c  | 21 -
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..aff4f60 100644
+--- a/src/programs/pkcheck.c
 b/src/programs/pkcheck.c
+@@ -363,6 +363,12 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+
++  if (argc < 1)
++{
++  help();
++  exit(1);
++}
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..3ff4c58 100644
+--- a/src/programs/pkexec.c
 b/src/programs/pkexec.c
+@@ -488,6 +488,17 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+
++
++  /*
++   * If 'pkexec' is called wrong, just show help and bail out.
++   */
++  if (argc<1)
++{
++  clearenv();
++  usage(argc, argv);
++  exit(1);
++}
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -636,7 +647,15 @@ main (int argc, char *argv[])
+   goto out;
+ }
+   g_free (path);
+-  argv[n] = path = s;
++  path = s;
++
++  /* argc<2 and pkexec runs just shell, argv is guaranteed to be 
null-terminated.
++   * /-less shell shouldn't happen, but let's be defensive and don't 
write to null-termination
++   */
++  if (argv[n] != NULL)
++  {
++argv[n] = path;
++  }
+ }
+   if (access (path, F_OK) != 0)
+ {
+--
+2.26.2
+
diff --git a/meta-oe/recipes-extended/polkit/polkit_0.116.bb 
b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
index ad1973b13..77288b008 100644
--- a/meta-oe/recipes-extended/polkit/polkit_0.116.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
@@ -25,6 +25,7 @@ PAM_SRC_URI = "file://polkit-1_pam.patch"
 SRC_URI = 
"https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freedesktop.org%2Fsoftware%2Fpolkit%2Freleases%2Fpolkit-%24data=04%7C01%7Cranjitsinh.rathod%40kpit.com%7C45f46f1f615a4eb760cf08d9e12a0005%7C3539451eb46e4a26a242ff61502855c7%7C0%7C0%7C637788392834981462%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000sdata=9cmvANRDGaMrybHCR%2BkvTIvPKOmz4UdAoqtD0XEmWpk%3Dreserved=0{PV}.tar.gz
 \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', 
'', d)} \
file://0003-make-netgroup-support-optional.patch \
+   file://CVE-2021-4034.patch \
"
 SRC_URI[md5sum] = "4b37258583393e83069a0e2e89c0162a"
 SRC_URI[sha

[oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

2022-01-26 Thread Jeremy Puhlman

Upstream-Status: Backport
CVE: CVE-2021-3466
Signed-off-by: Jeremy A. Puhlman 
---
 .../polkit/files/CVE-2021-4034.patch  | 71 +++
 .../recipes-extended/polkit/polkit_0.116.bb   |  1 +
 2 files changed, 72 insertions(+)
 create mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch

diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch 
b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
new file mode 100644
index 0..294ada961
--- /dev/null
+++ b/meta-oe/recipes-extended/polkit/files/CVE-2021-4034.patch
@@ -0,0 +1,71 @@
+From ed8b418f1341cf7fc576f6b17de5c6dd4017e034 Mon Sep 17 00:00:00 2001
+From: "Jeremy A. Puhlman" 
+Date: Thu, 27 Jan 2022 00:01:27 +
+Subject: [PATCH] CVE-2021-4034: Local privilege escalation in pkexec due to 
+ incorrect handling of argument vector
+
+Upstream-Status: Backport 
https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
+---
+ src/programs/pkcheck.c |  6 ++
+ src/programs/pkexec.c  | 21 -
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..aff4f60 100644
+--- a/src/programs/pkcheck.c
 b/src/programs/pkcheck.c
+@@ -363,6 +363,12 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+ 
++  if (argc < 1)
++{
++  help();
++  exit(1);
++}
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+ 
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..3ff4c58 100644
+--- a/src/programs/pkexec.c
 b/src/programs/pkexec.c
+@@ -488,6 +488,17 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+ 
++
++  /*
++   * If 'pkexec' is called wrong, just show help and bail out.
++   */
++  if (argc<1)
++{
++  clearenv();
++  usage(argc, argv);
++  exit(1);
++}
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -636,7 +647,15 @@ main (int argc, char *argv[])
+   goto out;
+ }
+   g_free (path);
+-  argv[n] = path = s;
++  path = s;
++
++  /* argc<2 and pkexec runs just shell, argv is guaranteed to be 
null-terminated.
++   * /-less shell shouldn't happen, but let's be defensive and don't 
write to null-termination
++   */
++  if (argv[n] != NULL)
++  {
++argv[n] = path;
++  }
+ }
+   if (access (path, F_OK) != 0)
+ {
+-- 
+2.26.2
+
diff --git a/meta-oe/recipes-extended/polkit/polkit_0.116.bb 
b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
index ad1973b13..77288b008 100644
--- a/meta-oe/recipes-extended/polkit/polkit_0.116.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_0.116.bb
@@ -25,6 +25,7 @@ PAM_SRC_URI = "file://polkit-1_pam.patch"
 SRC_URI = 
"http://www.freedesktop.org/software/polkit/releases/polkit-${PV}.tar.gz \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', 
'', d)} \
file://0003-make-netgroup-support-optional.patch \
+   file://CVE-2021-4034.patch \
"
 SRC_URI[md5sum] = "4b37258583393e83069a0e2e89c0162a"
 SRC_URI[sha256sum] = 
"88170c9e711e8db305a12fdb8234fac5706c61969b94e084d0f117d8ec5d34b1"
-- 
2.20.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#95110): 
https://lists.openembedded.org/g/openembedded-devel/message/95110
Mute This Topic: https://lists.openembedded.org/mt/88710808/21656
Group Owner: openembedded-devel+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

Re: [oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

[oe] [meta-oe][dunfell][PATCH] CVE-2021-3466: polkit Local privilege escalation in pkexec due to incorrect handling of argument vector

4 matches

Site Navigation

Mail list logo

Footer information