Browse code
Fix for CVE-2017-17087
Issue: Others can read the swap file if a user is careless with his
primary group.
Solution: If the group permission allows for reading but the world
permissions doesn't, make sure the group is right.
Change-Id: Ifc70d235f88c45312621cf52d08ba37c9a69845f
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5332
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Sharath George
Tapas Kundu authored on 2018/07/10 20:40:26Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,64 @@ |
| 0 |
+From 5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 Mon Sep 17 00:00:00 2001 |
|
| 1 |
+From: Bram Moolenaar <Bram@vim.org> |
|
| 2 |
+Date: Sat, 4 Nov 2017 21:35:01 +0100 |
|
| 3 |
+Subject: [PATCH] patch 8.0.1263: others can read the swap file if a user is |
|
| 4 |
+ careless |
|
| 5 |
+ |
|
| 6 |
+Problem: Others can read the swap file if a user is careless with his |
|
| 7 |
+ primary group. |
|
| 8 |
+Solution: If the group permission allows for reading but the world |
|
| 9 |
+ permissions doesn't, make sure the group is right. |
|
| 10 |
+--- |
|
| 11 |
+ src/Makefile | 1 + |
|
| 12 |
+ src/fileio.c | 24 +++++++++- |
|
| 13 |
+ src/testdir/test_swap.vim | 112 ++++++++++++++++++++++++++++++---------------- |
|
| 14 |
+ src/version.c | 2 + |
|
| 15 |
+ 4 files changed, 99 insertions(+), 40 deletions(-) |
|
| 16 |
+ |
|
| 17 |
+diff --git a/src/Makefile b/src/Makefile |
|
| 18 |
+index e55e830..48487aa 100644 |
|
| 19 |
+--- a/src/Makefile |
|
| 20 |
+@@ -2259,6 +2259,7 @@ test_arglist \ |
|
| 21 |
+ test_stat \ |
|
| 22 |
+ test_statusline \ |
|
| 23 |
+ test_substitute \ |
|
| 24 |
++ test_swap \ |
|
| 25 |
+ test_syn_attr \ |
|
| 26 |
+ test_syntax \ |
|
| 27 |
+ test_system \ |
|
| 28 |
+diff --git a/src/fileio.c b/src/fileio.c |
|
| 29 |
+index 87b85cf..34dcdb6 100644 |
|
| 30 |
+--- a/src/fileio.c |
|
| 31 |
+@@ -716,7 +716,29 @@ readfile( |
|
| 32 |
+ /* Set swap file protection bits after creating it. */ |
|
| 33 |
+ if (swap_mode > 0 && curbuf->b_ml.ml_mfp != NULL |
|
| 34 |
+ && curbuf->b_ml.ml_mfp->mf_fname != NULL) |
|
| 35 |
+- (void)mch_setperm(curbuf->b_ml.ml_mfp->mf_fname, (long)swap_mode); |
|
| 36 |
++ {
|
|
| 37 |
++ char_u *swap_fname = curbuf->b_ml.ml_mfp->mf_fname; |
|
| 38 |
++ |
|
| 39 |
++ /* |
|
| 40 |
++ * If the group-read bit is set but not the world-read bit, then |
|
| 41 |
++ * the group must be equal to the group of the original file. If |
|
| 42 |
++ * we can't make that happen then reset the group-read bit. This |
|
| 43 |
++ * avoids making the swap file readable to more users when the |
|
| 44 |
++ * primary group of the user is too permissive. |
|
| 45 |
++ */ |
|
| 46 |
++ if ((swap_mode & 044) == 040) |
|
| 47 |
++ {
|
|
| 48 |
++ stat_T swap_st; |
|
| 49 |
++ |
|
| 50 |
++ if (mch_stat((char *)swap_fname, &swap_st) >= 0 |
|
| 51 |
++ && st.st_gid != swap_st.st_gid |
|
| 52 |
++ && fchown(curbuf->b_ml.ml_mfp->mf_fd, -1, st.st_gid) |
|
| 53 |
++ == -1) |
|
| 54 |
++ swap_mode &= 0600; |
|
| 55 |
++ } |
|
| 56 |
++ |
|
| 57 |
++ (void)mch_setperm(swap_fname, (long)swap_mode); |
|
| 58 |
++ } |
|
| 59 |
+ #endif |
|
| 60 |
+ } |
|
| 61 |
+ |
| ... | ... |
@@ -3,7 +3,7 @@ |
| 3 | 3 |
Summary: Text editor |
| 4 | 4 |
Name: vim |
| 5 | 5 |
Version: 8.0.0533 |
| 6 |
-Release: 3%{?dist}
|
|
| 6 |
+Release: 4%{?dist}
|
|
| 7 | 7 |
License: Charityware |
| 8 | 8 |
URL: http://www.vim.org |
| 9 | 9 |
Group: Applications/Editors |
| ... | ... |
@@ -12,6 +12,7 @@ Distribution: Photon |
| 12 | 12 |
Source0: %{name}-%{version}.tar.gz
|
| 13 | 13 |
%define sha1 vim=6169cece15cb139db3ceff9c9ba2bf74013b1e02 |
| 14 | 14 |
BuildRequires: ncurses-devel |
| 15 |
+Patch0: CVE-2017-17087.patch |
|
| 15 | 16 |
|
| 16 | 17 |
%description |
| 17 | 18 |
The Vim package contains a powerful text editor. |
| ... | ... |
@@ -26,6 +27,8 @@ The vim extra package contains a extra files for powerful text editor. |
| 26 | 26 |
|
| 27 | 27 |
%prep |
| 28 | 28 |
%setup -q |
| 29 |
+%patch0 -p1 |
|
| 30 |
+ |
|
| 29 | 31 |
echo '#define SYS_VIMRC_FILE "/etc/vimrc"' >> src/feature.h |
| 30 | 32 |
%build |
| 31 | 33 |
./configure \ |
| ... | ... |
@@ -165,6 +168,8 @@ make test |
| 165 | 165 |
%{_bindir}/vimdiff
|
| 166 | 166 |
|
| 167 | 167 |
%changelog |
| 168 |
+* Tue Jul 10 2018 Tapas Kundu <tkundu@vmware.com> 8.0.0533-4 |
|
| 169 |
+- Fix for CVE-2017-17087.patch. |
|
| 168 | 170 |
* Mon Aug 14 2017 Chang Lee <changlee@vmware.com> 8.0.0533-3 |
| 169 | 171 |
- Disabled Test_recover_root_dir in %check |
| 170 | 172 |
* Tue May 02 2017 Anish Swaminathan <anishs@vmware.com> 8.0.0533-2 |