Attachment 127124 Details for Bug 98157 – dbus_activation_systemd_failure: do not use non-literal format string

[patch] dbus_activation_systemd_failure: do not use non-literal format string

0001-dbus_activation_systemd_failure-do-not-use-non-liter.patch (text/plain), 1.92 KB, created by Simon McVittie on 2016-10-07 20:08:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2016-10-07 20:08:58 UTC

Size: 1.92 KB

patch

obsolete

>From 9c9ab4587a35aec59ffc24628429eb478f6caa3d Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Fri, 7 Oct 2016 19:13:01 +0100
>Subject: [PATCH] dbus_activation_systemd_failure: do not use non-literal
> format string
>
>In principle this could lead to arbitrary memory overwrite via
>a format string attack in the message received from systemd,
>resulting in arbitrary code execution.
>
>This is not believed to be a practical security vulnerability on the
>system bus in practice: it can only be exploited by the owner of the
>org.freedesktop.systemd1 bus name, which is restricted to uid 0, so
>if systemd is attacker-controlled then the system is already doomed.
>Similarly, if a systemd system unit mentioned in the activation failure
>message has an attacker-controlled name, then the attacker likely already
>has sufficient access to execute arbitrary code as root in any case.
>
>However, prior to dbus 1.8.16 and 1.9.10, due to a missing check for
>systemd's identity, unprivileged processes could forge activation
>failure messages which would have gone through this code path.
>We thought at the time that this was a denial of service vulnerability
>(CVE-2015-0245); this bug means that it was in fact potentially an
>arbitrary code execution vulnerability.
>
>Bug found using -Wsuggest-attribute=format and -Wformat-security.
>
>Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
>---
> bus/activation.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/bus/activation.c b/bus/activation.c
>index 2c5ef9d..1e59190 100644
>--- a/bus/activation.c
>+++ b/bus/activation.c
>@@ -2222,7 +2222,7 @@ dbus_activation_systemd_failure (BusActivation *activation,
>                              DBUS_TYPE_STRING, &code,
>                              DBUS_TYPE_STRING, &str,
>                              DBUS_TYPE_INVALID))
>-    dbus_set_error(&error, code, str);
>+    dbus_set_error (&error, code, "%s", str);
> 
> 
>   if (unit)
>-- 
>2.9.3
>

Actions: View | Splinter Review

Attachments on bug 98157: 127124 | 127125 | 127127 | 127128

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.