diff options
| author | Marius Bakke <marius@gnu.org> | 2021-06-19 17:38:47 +0200 |
|---|---|---|
| committer | Marius Bakke <marius@gnu.org> | 2021-06-19 17:38:47 +0200 |
| commit | 6f9a80b331ae41d142a49fbeb94b90ee587b6155 (patch) | |
| tree | 2da042a6ccf5368c73d6e3d54c2ee02a62d284e4 /gnu/packages/patches/polkit-CVE-2021-3560.patch | |
| parent | 6500c9a5b364616e38a7e03aa4516fc2d7cee876 (diff) | |
| parent | dece03e2b98fc1c2428c2448ce5792f813eb79bf (diff) | |
Merge branch 'master' into core-updates
Note: this merge actually changes the 'curl' and 'python-attrs' derivations,
as part of solving caf4a7a2770ef4d05a6e18f40d602e51da749ddc and
12964df69a99de6190422c752fef65ef813f3b6b respectively.
4604d43c0e (gnu: gnutls@3.6.16: Fix cross-compilation.) was ignored because it
cannot currently be tested.
Conflicts:
gnu/local.mk
gnu/packages/aidc.scm
gnu/packages/boost.scm
gnu/packages/curl.scm
gnu/packages/nettle.scm
gnu/packages/networking.scm
gnu/packages/python-xyz.scm
gnu/packages/tls.scm
Diffstat (limited to 'gnu/packages/patches/polkit-CVE-2021-3560.patch')
| -rw-r--r-- | gnu/packages/patches/polkit-CVE-2021-3560.patch | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/gnu/packages/patches/polkit-CVE-2021-3560.patch b/gnu/packages/patches/polkit-CVE-2021-3560.patch new file mode 100644 index 0000000000..9aa0373fda --- /dev/null +++ b/gnu/packages/patches/polkit-CVE-2021-3560.patch @@ -0,0 +1,21 @@ +This patch fixes CVE-2021-3560, "local privilege escalation using +polkit_system_bus_name_get_creds_sync()": + + https://www.openwall.com/lists/oss-security/2021/06/03/1 + +Patch from <https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a>. + +diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c +index 8daa12cb9093c1d765c7b83654a2b8d0d382378e..8ed13631508dd96624898df90ee2ece4dcf3e1e5 100644 +--- a/src/polkit/polkitsystembusname.c ++++ b/src/polkit/polkitsystembusname.c +@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus + while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error)) + g_main_context_iteration (tmp_context, TRUE); + ++ if (data.caught_error) ++ goto out; ++ + if (out_uid) + *out_uid = data.uid; + if (out_pid) |