diff options
| author | Sam Hartman <hartmans@debian.org> | 2024-02-02 11:38:09 -0700 |
|---|---|---|
| committer | Sam Hartman <hartmans@debian.org> | 2024-02-29 09:46:54 -0700 |
| commit | be0837307eb286bf5c14c11a2ae47db8106fbaac (patch) | |
| tree | 2b499edb4208f9510892485fc8c0113eb4126563 /debian/watch | |
| parent | b9a8890a053ae2a1827853dc2359aa391a5025ee (diff) | |
From: Matthias Gerstner <matthias.gerstner@suse.de> Date: Wed, 27 Dec 2023 14:01:59 +0100 Subject: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations Origin: https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb Bug-Debian: https://bugs.debian.org/1061097 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-22365
Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.
Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.
With this the check whether the final path element is a directory
becomes unnecessary, drop it.
Gbp-Pq: Name pam_namespace_o_directory
Diffstat (limited to 'debian/watch')
0 files changed, 0 insertions, 0 deletions