pam erbuild

system/base/pam/files/CVE-2020-27780.patch

@@ -0,0 +1,95 @@
+From 30fdfb90d9864bcc254a62760aaa149d373fd4eb Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tmraz@fedoraproject.org>
+Date: Fri, 20 Nov 2020 13:38:23 +0100
+Subject: [PATCH] Second blank check with root for non-existent users must
+ never return 1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The commit af0faf66 ("pam_unix: avoid determining if user exists") introduced
+a regression where the blank check could return 1 if root had an empty
+password hash because in the second case the password hash of root was
+used. We now always return 0 in this case.
+
+The issue was found by Johannes Löthberg.
+
+Fixes #284
+
+* modules/pam_unix/support.c (_unix_blankpasswd): Make the loop
+to cover the complete blank check so both existing and non existing
+cases are identical except for the possible return value.
+---
+ modules/pam_unix/support.c | 39 +++++++++++++-------------------------
+ 1 file changed, 13 insertions(+), 26 deletions(-)
+
+diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
+index d669e951..27ca7127 100644
+--- a/modules/pam_unix/support.c
++++ b/modules/pam_unix/support.c
+@@ -601,8 +601,9 @@ _unix_blankpasswd (pam_handle_t *pamh, unsigned long long ctrl, const char *name
+ 	char *salt = NULL;
+ 	int daysleft;
+ 	int retval;
+-	int execloop = 1;
+-	int nonexistent = 1;
++	int blank = 0;
++	int execloop;
++	int nonexistent_check = 1;
+ 
+ 	D(("called"));
+ 
+@@ -632,43 +633,29 @@ _unix_blankpasswd (pam_handle_t *pamh, unsigned long long ctrl, const char *name
+ 	 * are equal, making it more difficult to differentiate existing from
+ 	 * non-existing users.
+ 	 */
+-	while (execloop) {
++	for (execloop = 0; execloop < 2; ++execloop) {
+ 		retval = get_pwd_hash(pamh, name, &pwd, &salt);
+ 
+ 		if (retval == PAM_UNIX_RUN_HELPER) {
+-			execloop = 0;
+-			if(nonexistent) {
+-				get_pwd_hash(pamh, "pam_unix_non_existent:", &pwd, &salt);
+-			}
+-			/* salt will not be set here so we can return immediately */
+ 			if (_unix_run_helper_binary(pamh, NULL, ctrl, name) == PAM_SUCCESS)
+-				return 1;
+-			else
+-				return 0;
++				blank = nonexistent_check;
+ 		} else if (retval == PAM_USER_UNKNOWN) {
+ 			name = "root";
+-			nonexistent = 0;
+-		} else {
+-			execloop = 0;
++			nonexistent_check = 0;
++			continue;
++		} else if (salt != NULL) {
++			if (strlen(salt) == 0)
++				blank = nonexistent_check;
+ 		}
+-	}
+-
+-	/* Does this user have a password? */
+-	if (salt == NULL) {
+-		retval = 0;
+-	} else {
+-		if (strlen(salt) == 0)
+-			retval = 1;
+-		else
+-			retval = 0;
++		name = "pam_unix_non_existent:";
++		/* non-existent user check will not affect the blank value */
+ 	}
+ 
+ 	/* tidy up */
+-
+ 	if (salt)
+ 		_pam_delete(salt);
+ 
+-	return retval;
++	return blank;
+ }
+ 
+ int _unix_verify_password(pam_handle_t * pamh, const char *name

system/base/pam/pspec.xml

@@ -26,7 +26,7 @@
             <Dependency>docbook-xsl</Dependency>
         </BuildDependencies>
         <Patches>
-<!--             <Patch level="1">Linux-PAM-1.1.6-destdir.patch</Patch> -->
+            <Patch level="1">CVE-2020-27780.patch</Patch>
 <!--              <Patch level="1">fedora/pam-1.4.0-full-relro.patch</Patch> -->
         </Patches>
     </Source>
@@ -71,7 +71,7 @@
 
     <History>
         <Update release="6">
-            <Date>2020-12-09</Date>
+            <Date>2020-12-25</Date>
             <Version>1.5.0</Version>
             <Comment>Version bump.</Comment>
             <Name>Mustafa Cinasal</Name>