mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 21:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

sudo: Fix CVE-2023-22809

Browse Source 
Add CVE-2023-22809.patch to fix CVE-2023-22809.

(From OE-Core rev: 186a5ab41927e6be0920e03e743f32ae4477c58e)

Signed-off-by: Omkar Patil <omkar.patil@kpit.com>
Signed-off-by: pawan <badganchipv@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Omkar Patil
2023-02-08 17:18:46 +05:30
committed by Richard Purdie
parent 3c3039aac4
commit 50108e2180
2 changed files with 114 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
meta/recipes-extended/sudo/files/CVE-2023-22809.patch Normal file
View File

@@ -0,0 +1,113 @@
Backport of:
# HG changeset patch
# Parent 7275148cad1f8cd3c350026460acc4d6ad349c3a
sudoedit: do not permit editor arguments to include "--"
We use "--" to separate the editor and arguments from the files to edit.
If the editor arguments include "--", sudo can be tricked into allowing
the user to edit a file not permitted by the security policy.
Thanks to Matthieu Barjole and Victor Cutillas of Synacktiv
(https://synacktiv.com) for finding this bug.
CVE: CVE-2023-22809
Upstream-Staus: Backport [http://archive.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.8.31-1ubuntu1.4.debian.tar.xz]
Signed-off-by: Omkar Patil <omkar.patil@kpit.com>
--- a/plugins/sudoers/editor.c
+++ b/plugins/sudoers/editor.c
@@ -56,7 +56,7 @@ resolve_editor(const char *ed, size_t ed
const char *cp, *ep, *tmp;
const char *edend = ed + edlen;
struct stat user_editor_sb;
- int nargc;
+ int nargc = 0;
debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL)
/*
@@ -102,6 +102,21 @@ resolve_editor(const char *ed, size_t ed
free(editor_path);
while (nargc--)
free(nargv[nargc]);
+ free(nargv);
+ debug_return_str(NULL);
+ }
+
+ /*
+ * We use "--" to separate the editor and arguments from the files
+ * to edit. The editor arguments themselves may not contain "--".
+ */
+ if (strcmp(nargv[nargc], "--") == 0) {
+ sudo_warnx(U_("ignoring editor: %.*s"), (int)edlen, ed);
+ sudo_warnx("%s", U_("editor arguments may not contain \"--\""));
+ errno = EINVAL;
+ free(editor_path);
+ while (nargc--)
+ free(nargv[nargc]);
free(nargv);
debug_return_str(NULL);
}
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -616,20 +616,31 @@ sudoers_policy_main(int argc, char * con
/* Note: must call audit before uid change. */
if (ISSET(sudo_mode, MODE_EDIT)) {
+ const char *env_editor = NULL;
int edit_argc;
- const char *env_editor;
free(safe_cmnd);
safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc,
&edit_argv, NULL, &env_editor, false);
if (safe_cmnd == NULL) {
- if (errno != ENOENT)
+ switch (errno) {
+ case ENOENT:
+ audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
+ env_editor ? env_editor : def_editor);
+ sudo_warnx(U_("%s: command not found"),
+ env_editor ? env_editor : def_editor);
+ goto bad;
+ case EINVAL:
+ if (def_env_editor && env_editor != NULL) {
+ /* User tried to do something funny with the editor. */
+ log_warningx(SLOG_NO_STDERR|SLOG_SEND_MAIL,
+ "invalid user-specified editor: %s", env_editor);
+ goto bad;
+ }
+ /* FALLTHROUGH */
+ default:
goto done;
- audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
- env_editor ? env_editor : def_editor);
- sudo_warnx(U_("%s: command not found"),
- env_editor ? env_editor : def_editor);
- goto bad;
+ }
}
if (audit_success(edit_argc, edit_argv) != 0 && !def_ignore_audit_errors)
goto done;
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -308,7 +308,7 @@ static char *
get_editor(int *editor_argc, char ***editor_argv)
{
char *editor_path = NULL, **whitelist = NULL;
- const char *env_editor;
+ const char *env_editor = NULL;
static char *files[] = { "+1", "sudoers" };
unsigned int whitelist_len = 0;
debug_decl(get_editor, SUDOERS_DEBUG_UTIL)
@@ -342,7 +342,11 @@ get_editor(int *editor_argc, char ***edi
if (editor_path == NULL) {
if (def_env_editor && env_editor != NULL) {
/* We are honoring $EDITOR so this is a fatal error. */
- sudo_fatalx(U_("specified editor (%s) doesn't exist"), env_editor);
+ if (errno == ENOENT) {
+ sudo_warnx(U_("specified editor (%s) doesn't exist"),
+ env_editor);
+ }
+ exit(EXIT_FAILURE);
}
sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
}

1
meta/recipes-extended/sudo/sudo_1.8.32.bb
View File

@@ -5,6 +5,7 @@ SRC_URI = "https://www.sudo.ws/dist/sudo-${PV}.tar.gz \
file://0001-Include-sys-types.h-for-id_t-definition.patch \
file://0001-Fix-includes-when-building-with-musl.patch \
file://CVE-2022-43995.patch \
file://CVE-2023-22809.patch \
"
PAM_SRC_URI = "file://sudo.pam"