From 34a74aadf6fe397e8aadb294e984c3080d232702 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Thu, 27 Nov 2014 14:39:25 +0100 Subject: [PATCH] 2.25.2-2: CVE-2014-9114 --- 2.26-libblkid-escape.patch | 126 +++++++++++++++++++++++++++++++++++++ util-linux.spec | 10 ++- 2 files changed, 134 insertions(+), 2 deletions(-) create mode 100644 2.26-libblkid-escape.patch diff --git a/2.26-libblkid-escape.patch b/2.26-libblkid-escape.patch new file mode 100644 index 0000000..acde467 --- /dev/null +++ b/2.26-libblkid-escape.patch @@ -0,0 +1,126 @@ +diff -up util-linux-2.25.2/include/carefulputc.h.kzak util-linux-2.25.2/include/carefulputc.h +--- util-linux-2.25.2/include/carefulputc.h.kzak 2014-10-24 11:21:20.309387887 +0200 ++++ util-linux-2.25.2/include/carefulputc.h 2014-11-27 14:25:52.814604767 +0100 +@@ -38,6 +38,8 @@ static inline void fputs_quoted(const ch + for (p = data; p && *p; p++) { + if ((unsigned char) *p == 0x22 || /* " */ + (unsigned char) *p == 0x5c || /* \ */ ++ (unsigned char) *p == 0x60 || /* ` */ ++ (unsigned char) *p == 0x24 || /* $ */ + !isprint((unsigned char) *p) || + iscntrl((unsigned char) *p)) { + +diff -up util-linux-2.25.2/libblkid/src/read.c.kzak util-linux-2.25.2/libblkid/src/read.c +--- util-linux-2.25.2/libblkid/src/read.c.kzak 2014-09-16 14:37:06.147551766 +0200 ++++ util-linux-2.25.2/libblkid/src/read.c 2014-11-27 14:26:02.848721993 +0100 +@@ -252,15 +252,30 @@ static int parse_token(char **name, char + *value = skip_over_blank(*value + 1); + + if (**value == '"') { +- end = strchr(*value + 1, '"'); +- if (!end) { ++ char *p = end = *value + 1; ++ ++ /* convert 'foo\"bar' to 'foo"bar' */ ++ while (*p) { ++ if (*p == '\\') { ++ p++; ++ *end = *p; ++ } else { ++ *end = *p; ++ if (*p == '"') ++ break; ++ } ++ p++; ++ end++; ++ } ++ ++ if (*end != '"') { + DBG(READ, ul_debug("unbalanced quotes at: %s", *value)); + *cp = *value; + return -BLKID_ERR_CACHE; + } + (*value)++; + *end = '\0'; +- end++; ++ end = ++p; + } else { + end = skip_over_word(*value); + if (*end) { +diff -up util-linux-2.25.2/libblkid/src/save.c.kzak util-linux-2.25.2/libblkid/src/save.c +--- util-linux-2.25.2/libblkid/src/save.c.kzak 2014-09-16 14:37:06.147551766 +0200 ++++ util-linux-2.25.2/libblkid/src/save.c 2014-11-27 14:26:02.848721993 +0100 +@@ -26,6 +26,21 @@ + + #include "blkidP.h" + ++ ++static void save_quoted(const char *data, FILE *file) ++{ ++ const char *p; ++ ++ fputc('"', file); ++ for (p = data; p && *p; p++) { ++ if ((unsigned char) *p == 0x22 || /* " */ ++ (unsigned char) *p == 0x5c) /* \ */ ++ fputc('\\', file); ++ ++ fputc(*p, file); ++ } ++ fputc('"', file); ++} + static int save_dev(blkid_dev dev, FILE *file) + { + struct list_head *p; +@@ -43,9 +58,14 @@ static int save_dev(blkid_dev dev, FILE + + if (dev->bid_pri) + fprintf(file, " PRI=\"%d\"", dev->bid_pri); ++ + list_for_each(p, &dev->bid_tags) { + blkid_tag tag = list_entry(p, struct blkid_struct_tag, bit_tags); +- fprintf(file, " %s=\"%s\"", tag->bit_name,tag->bit_val); ++ ++ fputc(' ', file); /* space between tags */ ++ fputs(tag->bit_name, file); /* tag NAME */ ++ fputc('=', file); /* separator between NAME and VALUE */ ++ save_quoted(tag->bit_val, file); /* tag "VALUE" */ + } + fprintf(file, ">%s\n", dev->bid_name); + +diff -up util-linux-2.25.2/misc-utils/blkid.8.kzak util-linux-2.25.2/misc-utils/blkid.8 +--- util-linux-2.25.2/misc-utils/blkid.8.kzak 2013-09-18 15:50:12.690263681 +0200 ++++ util-linux-2.25.2/misc-utils/blkid.8 2014-11-27 14:26:02.849722005 +0100 +@@ -193,7 +193,10 @@ partitions. This output format is \fBDE + .TP + .B export + print key=value pairs for easy import into the environment; this output format +-is automatically enabled when I/O Limits (\fB-i\fR option) are requested ++is automatically enabled when I/O Limits (\fB-i\fR option) are requested. ++ ++The non-printing characters are encoded by ^ and M- notation and all ++potentially unsafe characters are escaped. + .RE + .TP + .BI \-O " offset" +diff -up util-linux-2.25.2/misc-utils/blkid.c.kzak util-linux-2.25.2/misc-utils/blkid.c +--- util-linux-2.25.2/misc-utils/blkid.c.kzak 2014-10-24 11:29:07.834363569 +0200 ++++ util-linux-2.25.2/misc-utils/blkid.c 2014-11-27 14:26:02.849722005 +0100 +@@ -306,7 +306,7 @@ static void print_value(int output, int + printf("DEVNAME=%s\n", devname); + fputs(name, stdout); + fputs("=", stdout); +- safe_print(value, valsz, NULL); ++ safe_print(value, valsz, " \\\"'$`<>"); + fputs("\n", stdout); + + } else { +@@ -315,7 +315,7 @@ static void print_value(int output, int + fputs(" ", stdout); + fputs(name, stdout); + fputs("=\"", stdout); +- safe_print(value, valsz, "\""); ++ safe_print(value, valsz, "\"\\"); + fputs("\"", stdout); + } + } diff --git a/util-linux.spec b/util-linux.spec index da83701..fc1cc2f 100644 --- a/util-linux.spec +++ b/util-linux.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux Version: 2.25.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: http://en.wikipedia.org/wiki/Util-linux @@ -27,7 +27,7 @@ BuildRequires: libcap-ng-devel BuildRequires: python3-devel ### Sources -Source0: ftp://ftp.kernel.org/pub/linux/utils/util-linux/v2.24/util-linux-%{upstream_version}.tar.xz +Source0: ftp://ftp.kernel.org/pub/linux/utils/util-linux/v2.25/util-linux-%{upstream_version}.tar.xz Source1: util-linux-login.pamd Source2: util-linux-remote.pamd Source3: util-linux-chsh-chfn.pamd @@ -77,6 +77,9 @@ Requires: libsmartcols = %{version}-%{release} # 151635 - makeing /var/log/lastlog Patch0: 2.23-login-lastlog-create.patch +# 1168490 - CVE-2014-9114 util-linux: command injection flaw in blkid +Patch1: 2.26-libblkid-escape.patch + %description The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among @@ -835,6 +838,9 @@ exit 0 %{_libdir}/python*/site-packages/libmount/* %changelog +* Thu Nov 27 2014 Karel Zak 2.25.2-2 +- fix #1168490 - CVE-2014-9114 util-linux: command injection flaw in blkid + * Wed Oct 24 2014 Karel Zak 2.25.2-1 - upgrade to stable 2.25.2 ftp://ftp.kernel.org/pub/linux/utils/util-linux/v2.25/v2.25.2-ReleaseNotes