new file mode 100644

@@ -0,0 +1,44 @@

+From 28bdae3d113ef479c1660a581ef720cdc33bf466 Mon Sep 17 00:00:00 2001

+From: Jann Horn <jannh@google.com>

+Date: Fri, 13 Jul 2018 15:15:36 -0700

+Subject: [PATCH] fusermount: don't feed "escaped commas" into mount options

+

+The old code permits the following behavior:

+

+$ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount

+mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument)

+

+However, backslashes do not have any special meaning for the kernel here.

+

+As it happens, you can't abuse this because there is no FUSE mount option

+that takes a string value that can contain backslashes; but this is very

+brittle. Don't interpret "escape characters" in places where they don't

+work.

+---

+ util/fusermount.c | 5 ++++-

+ 1 file changed, 4 insertions(+), 1 deletion(-)

+

+diff --git a/util/fusermount.c b/util/fusermount.c

+index 0e1d34d1..143bd4ac 100644

+--- a/util/fusermount.c

+@@ -29,6 +29,7 @@

+ #include <sys/socket.h>

+ #include <sys/utsname.h>

+ #include <sched.h>

++#include <stdbool.h>

+ 

+ #define FUSE_COMMFD_ENV		"_FUSE_COMMFD"

+ 

+@@ -754,8 +755,10 @@ static int do_mount(const char *mnt, char **typep, mode_t rootmode,

+ 		unsigned len;

+ 		const char *fsname_str = "fsname=";

+ 		const char *subtype_str = "subtype=";

++		bool escape_ok = begins_with(s, fsname_str) ||

++				 begins_with(s, subtype_str);

+ 		for (len = 0; s[len]; len++) {

+-			if (s[len] == '\\' && s[len + 1])

++			if (escape_ok && s[len] == '\\' && s[len + 1])

+ 				len++;

+ 			else if (s[len] == ',')

+ 				break;

new file mode 100644

@@ -0,0 +1,40 @@

+From 5018a0c016495155ee598b7e0167b43d5d902414 Mon Sep 17 00:00:00 2001

+From: Jann Horn <jannh@google.com>

+Date: Sat, 14 Jul 2018 03:47:50 -0700

+Subject: [PATCH] fusermount: refuse unknown options

+

+Blacklists are notoriously fragile; especially if the kernel wishes to add

+some security-critical mount option at a later date, all existing systems

+with older versions of fusermount installed will suddenly have a security

+problem.

+Additionally, if the kernel's option parsing became a tiny bit laxer, the

+blacklist could probably be bypassed.

+

+Whitelist known-harmless flags instead, even if it's slightly more

+inconvenient.

+---

+ util/fusermount.c | 8 +++++++-

+ 1 file changed, 7 insertions(+), 1 deletion(-)

+

+diff --git a/util/fusermount.c b/util/fusermount.c

+index 4e0f51a3..27924073 100644

+--- a/util/fusermount.c

+@@ -819,10 +819,16 @@ static int do_mount(const char *mnt, char **typep, mode_t rootmode,

+ 						flags |= flag;

+ 					else

+ 						flags  &= ~flag;

+-				} else {

++				} else if (opt_eq(s, len, "default_permissions") ||

++					   opt_eq(s, len, "allow_other") ||

++					   begins_with(s, "max_read=") ||

++					   begins_with(s, "blksize=")) {

+ 					memcpy(d, s, len);

+ 					d += len;

+ 					*d++ = ',';

++				} else {

++					fprintf(stderr, "%s: unknown option '%.*s'\n", progname, len, s);

++					exit(1);

+ 				}

+ 			}

+ 		}

@@ -1,7 +1,7 @@

 Summary:	File System in Userspace (FUSE) utilities

 Name:           fuse

 Version:        2.9.5

-Release:        2%{?dist}

+Release:        3%{?dist}

 License:        GPL+

 Url:		http://fuse.sourceforge.net/

 Group:		System Environment/Base

@@ -9,6 +9,8 @@ Vendor:		VMware, Inc.

 Distribution:	Photon

 Source0:        https://github.com/libfuse/libfuse/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz

 %define sha1 fuse=bf71181cdc25f65e5757a8a14d352296722de2e3

+Patch0:         fuse-escaped-commas-CVE-2018-10906.patch

+Patch1:         fuse-refuse-unknown-options-CVE-2018-10906.patch

 %description

 With FUSE it is possible to implement a fully functional filesystem in a

 userspace program. 

@@ -22,6 +24,8 @@ It contains the libraries and header files to create fuse applications.

 %prep

 %setup -q

+%patch0 -p1

+%patch1 -p1

 %build

 ./configure --prefix=%{_prefix} --disable-static INIT_D_PATH=/tmp/init.d &&

 make %{?_smp_mflags}

@@ -51,6 +55,8 @@ install -v -m644    doc/{how-fuse-works,kernel.txt} \

 %{_prefix}/bin/fusermount

 %changelog

+*	Fri Jan 18 2019 Ankit Jain <ankitja@vmware.com> 2.9.5-3

+-	Fix for CVE-2018-10906, added two patches

 *	Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 2.9.5-2

 -	GA - Bump release of all rpms

 *   Tue Jan 26 2016 Xiaolin Li <xiaolinl@vmware.com> 2.9.5-1