You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
2.8 KiB
71 lines
2.8 KiB
From d8f7346b329f6594eeb32318c37fadde391c19b2 Mon Sep 17 00:00:00 2001
|
|
Message-ID: <d8f7346b329f6594eeb32318c37fadde391c19b2.1786713644.git.jdenemar@redhat.com>
|
|
From: =?UTF-8?q?HE=20WEI=EF=BC=88=E3=82=AE=E3=82=AB=E3=82=AF=EF=BC=89?=
|
|
<skyexpoc@gmail.com>
|
|
Date: Tue, 28 Jul 2026 17:49:02 +0100
|
|
Subject: [PATCH] util: virFileChownFiles: do not follow symlinks
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows
|
|
symlinks) and changed ownership with chown() (follows symlinks). A component
|
|
that owns the target directory at a lower privilege (e.g. the swtpm/tss state
|
|
directory) can plant a symlink to an arbitrary regular file and have the root
|
|
caller chown that file. Use lstat() to skip non-regular entries and
|
|
fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never
|
|
followed.
|
|
|
|
Fixes: CVE-2026-63622
|
|
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
|
|
[DB: use g_lstat instead of stat; use lchown instead of
|
|
fchownat for portability; added comment]
|
|
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
(cherry picked from commit 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b)
|
|
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
---
|
|
src/util/virfile.c | 16 ++++++++++++++--
|
|
1 file changed, 14 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/util/virfile.c b/src/util/virfile.c
|
|
index a0c6cb8048..c9d838eeeb 100644
|
|
--- a/src/util/virfile.c
|
|
+++ b/src/util/virfile.c
|
|
@@ -3306,6 +3306,12 @@ int virDirIsEmpty(const char *path,
|
|
*
|
|
* Change ownership of all regular files in a directory.
|
|
*
|
|
+ * This will NOT follow any symlinks, to avoid security risks.
|
|
+ * It is assumed the process using content under @name will
|
|
+ * be unprivileged, thus less trusted than libvirt. If it is
|
|
+ * compromised it might attempt to create symlinks in @name to
|
|
+ * escalate privileges on a subsequent call to virFileChownFiles.
|
|
+ *
|
|
* Returns -1 on error, with error already reported, 0 on success.
|
|
*/
|
|
#ifndef WIN32
|
|
@@ -3322,13 +3328,19 @@ int virFileChownFiles(const char *name,
|
|
|
|
while ((direrr = virDirRead(dir, &ent, name)) > 0) {
|
|
g_autofree char *path = NULL;
|
|
+ struct stat sb;
|
|
|
|
path = g_build_filename(name, ent->d_name, NULL);
|
|
|
|
- if (!virFileIsRegular(path))
|
|
+ if (g_lstat(path, &sb) < 0) {
|
|
+ virReportSystemError(errno, _("cannot stat '%1$s'"), path);
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (!S_ISREG(sb.st_mode))
|
|
continue;
|
|
|
|
- if (chown(path, uid, gid) < 0) {
|
|
+ if (lchown(path, uid, gid) < 0) {
|
|
virReportSystemError(errno,
|
|
_("cannot chown '%1$s' to (%2$u, %3$u)"),
|
|
ent->d_name, (unsigned int) uid,
|
|
--
|
|
2.55.0
|
|
|