Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pam erbuild

Browse Source
This commit is contained in:
Rmys
2020-12-25 12:22:58 +03:00
committed by GitHub
parent 00d041205c
commit 28aeb2c69c
2 changed files with 97 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/pam/files/CVE-2020-27780.patch
+95
View File
@@ -0,0 +1,95 @@
From 30fdfb90d9864bcc254a62760aaa149d373fd4eb Mon Sep 17 00:00:00 2001
From: Tomas Mraz <tmraz@fedoraproject.org>
Date: Fri, 20 Nov 2020 13:38:23 +0100
Subject: [PATCH] Second blank check with root for non-existent users must
never return 1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The commit af0faf66 ("pam_unix: avoid determining if user exists") introduced
a regression where the blank check could return 1 if root had an empty
password hash because in the second case the password hash of root was
used. We now always return 0 in this case.
The issue was found by Johannes Löthberg.
Fixes #284
* modules/pam_unix/support.c (_unix_blankpasswd): Make the loop
to cover the complete blank check so both existing and non existing
cases are identical except for the possible return value.
---
modules/pam_unix/support.c | 39 +++++++++++++-------------------------
1 file changed, 13 insertions(+), 26 deletions(-)
diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
index d669e951..27ca7127 100644
--- a/modules/pam_unix/support.c
+++ b/modules/pam_unix/support.c
@@ -601,8 +601,9 @@ _unix_blankpasswd (pam_handle_t *pamh, unsigned long long ctrl, const char *name
char *salt = NULL;
int daysleft;
int retval;
- int execloop = 1;
- int nonexistent = 1;
+ int blank = 0;
+ int execloop;
+ int nonexistent_check = 1;
D(("called"));
@@ -632,43 +633,29 @@ _unix_blankpasswd (pam_handle_t *pamh, unsigned long long ctrl, const char *name
* are equal, making it more difficult to differentiate existing from
* non-existing users.
*/
- while (execloop) {
+ for (execloop = 0; execloop < 2; ++execloop) {
retval = get_pwd_hash(pamh, name, &pwd, &salt);
if (retval == PAM_UNIX_RUN_HELPER) {
- execloop = 0;
- if(nonexistent) {
- get_pwd_hash(pamh, "pam_unix_non_existent:", &pwd, &salt);
- }
- /* salt will not be set here so we can return immediately */
if (_unix_run_helper_binary(pamh, NULL, ctrl, name) == PAM_SUCCESS)
- return 1;
- else
- return 0;
+ blank = nonexistent_check;
} else if (retval == PAM_USER_UNKNOWN) {
name = "root";
- nonexistent = 0;
- } else {
- execloop = 0;
+ nonexistent_check = 0;
+ continue;
+ } else if (salt != NULL) {
+ if (strlen(salt) == 0)
+ blank = nonexistent_check;
}
- }
-
- /* Does this user have a password? */
- if (salt == NULL) {
- retval = 0;
- } else {
- if (strlen(salt) == 0)
- retval = 1;
- else
- retval = 0;
+ name = "pam_unix_non_existent:";
+ /* non-existent user check will not affect the blank value */
}
/* tidy up */
-
if (salt)
_pam_delete(salt);
- return retval;
+ return blank;
}
int _unix_verify_password(pam_handle_t * pamh, const char *name
system/base/pam/pspec.xml
+2 -2
View File
@@ -26,7 +26,7 @@
<Dependency>docbook-xsl</Dependency>
</BuildDependencies>
<Patches>
<!-- <Patch level="1">Linux-PAM-1.1.6-destdir.patch</Patch> -->
<Patch level="1">CVE-2020-27780.patch</Patch>
<!-- <Patch level="1">fedora/pam-1.4.0-full-relro.patch</Patch> -->
</Patches>
</Source>
@@ -71,7 +71,7 @@
<History>
<Update release="6">
<Date>2020-12-09</Date>
<Date>2020-12-25</Date>
<Version>1.5.0</Version>
<Comment>Version bump.</Comment>
<Name>Mustafa Cinasal</Name>