1. photon
  2. Commit e1f0edb63dfac0ad14b4ecc5e593d80f9de3f7bd
Browse code

Fix systemd CVE-2016-10156

Change-Id: I4856e53113e311617541ca07a2e0d13833cbf21f
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/2057
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: suezzelur <anishs@vmware.com>

Vinay Kulkarni authored on 2017/02/10 01:12:55
Showing 2 changed files
SPECS/systemd/systemd-228-CVE-2016-10156-suid-fix.patch
History View file @ e1f0edb
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,13 @@
0 
+diff -uNr systemd-228/src/basic/fs-util.c systemd-228-new/src/basic/fs-util.c
1 
+--- systemd-228/src/basic/fs-util.c	2017-02-07 23:47:47.432666702 +0000
2 
+@@ -327,7 +327,8 @@
3 
+         if (parents)
4 
+                 mkdir_parents(path, 0755);
5 
+
6 
+-        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644);
7 
++        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
8 
++                        (mode == 0 || mode == MODE_INVALID) ? 0644 : mode);
9 
+         if (fd < 0)
10 
+                 return -errno;
11 
+
SPECS/systemd/systemd.spec
History View file @ e1f0edb
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:          Systemd-228
2 2 
 Name:             systemd
3 3 
 Version:          228
4 
-Release:          33%{?dist}
4 
+Release:          34%{?dist}
5 5 
 License:          LGPLv2+ and GPLv2+ and MIT
6 6 
 URL:              http://www.freedesktop.org/wiki/Software/systemd/
7 7 
 Group:            System Environment/Security
... ... 
@@ -35,6 +35,7 @@ Patch19:          02-install-general-aliases.patch
35 35 
 Patch20:          systemd-228-CVE-notify-socket-DOS-fix.patch
36 36 
 Patch21:          systemd-macros.patch
37 37 
 Patch22:          systemd-228-vm-watchdog-timer.patch
38 
+Patch23:          systemd-228-CVE-2016-10156-suid-fix.patch
38 39 
 Requires:         Linux-PAM
39 40 
 Requires:         libcap
40 41 
 Requires:         xz
... ... 
@@ -90,6 +91,7 @@ sed -i "s:blkid/::" $(grep -rl "blkid/blkid.h")
90 90 
 %patch20 -p1
91 91 
 %patch21 -p1
92 92 
 %patch22 -p1
93 
+%patch23 -p1
93 94 
 sed -i "s#\#DefaultTasksMax=512#DefaultTasksMax=infinity#g" src/core/system.conf
94 95
95 96 
 %build
... ... 
@@ -199,6 +201,8 @@ rm -rf %{buildroot}/*
199 199 
 %dir %{_localstatedir}/log/journal
200 200
201 201 
 %changelog
202 
+*    Sat Jan 22 2017 Vinay Kulkarni <kulkarniv@vmware.com>  228-34
203 
+-    Fix for CVE-2016-10156.
202 204 
 *    Sat Jan 21 2017 Vinay Kulkarni <kulkarniv@vmware.com>  228-33
203 205 
 -    Arm watchdog timer more frequently for virtual machine env.
204 206 
 *    Thu Nov 3 2016 Divya Thaluru <dthaluru@vmware.com>  228-32