From 2a81de1df32f1caf1a7ded45fc4dc7c9d31e5837 Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Sun, 24 Oct 2021 07:10:41 +0200
Subject: [PATCH] Based on openssh-8.6p1-5.fc34

---
 gsi-openssh.spec                            |  8 ++++++-
 openssh-8.7p1-upstream-cve-2021-41617.patch | 25 +++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 openssh-8.7p1-upstream-cve-2021-41617.patch

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index cf39ddb..1cfa7dc 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -28,7 +28,7 @@
 %global libedit 1
 
 %global openssh_ver 8.6p1
-%global openssh_rel 2
+%global openssh_rel 3
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -153,6 +153,8 @@ Patch974: openssh-8.0p1-keygen-strip-doseol.patch
 Patch975: openssh-8.0p1-preserve-pam-errors.patch
 # ssh incorrectly restores the blocking mode on standard output (#1942901)
 Patch976: openssh-8.0p1-restore-nonblock.patch
+# CVE-2021-41617
+Patch978: openssh-8.7p1-upstream-cve-2021-41617.patch
 
 # Fix issue with read-only ssh buffer during gssapi key exchange (#1938224)
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/19
@@ -303,6 +305,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch974 -p1 -b .keygen-strip-doseol
 %patch975 -p1 -b .preserve-pam-errors
 %patch976 -p1 -b .restore-nonblock
+%patch978 -p1 -b .cve-2021-41617
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race
@@ -499,6 +502,9 @@ getent passwd sshd >/dev/null || \
 %attr(0644,root,root) %{_unitdir}/gsisshd-keygen.target
 
 %changelog
+* Sun Oct 24 2021 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.6p1-3
+- Based on openssh-8.6p1-5.fc34
+
 * Mon Jun 21 2021 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.6p1-2
 - Based on openssh-8.6p1-4.fc34
 
diff --git a/openssh-8.7p1-upstream-cve-2021-41617.patch b/openssh-8.7p1-upstream-cve-2021-41617.patch
new file mode 100644
index 0000000..15d49f2
--- /dev/null
+++ b/openssh-8.7p1-upstream-cve-2021-41617.patch
@@ -0,0 +1,25 @@
+diff --git a/misc.c b/misc.c
+index b8d1040d..0134d694 100644
+--- a/misc.c
++++ b/misc.c
+@@ -56,6 +56,7 @@
+ #ifdef HAVE_PATHS_H
+ # include <paths.h>
+ #include <pwd.h>
++#include <grp.h>
+ #endif
+ #ifdef SSH_TUN_OPENBSD
+ #include <net/if.h>
+@@ -2695,6 +2696,12 @@ subprocess(const char *tag, const char *command,
+ 		}
+ 		closefrom(STDERR_FILENO + 1);
+ 
++		if (geteuid() == 0 &&
++		    initgroups(pw->pw_name, pw->pw_gid) == -1) {
++			error("%s: initgroups(%s, %u): %s", tag,
++			    pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
++			_exit(1);
++		}
+ 		if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
+ 			error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
+ 			    strerror(errno));