diff options
| author | Greg Kurz <groug@kaod.org> | 2017-03-06 17:34:01 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2017-03-16 12:08:57 -0500 |
| commit | a15785cfbd2c58354cb27976b3659b6ac30a9601 (patch) | |
| tree | 807b620995d278ab852d2a695e2fc72aac2f0a6b /hw/9pfs | |
| parent | 3731a25a62840e4644c24f223c9940ef0f6430f2 (diff) | |
| download | qemu-a15785cfbd2c58354cb27976b3659b6ac30a9601.tar.gz | |
9pfs: fix vulnerability in openat_dir() and local_unlinkat_common()
We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make
QEMU vulnerable.
While here, we also fix local_unlinkat_common() to use openat_dir() for
the same reasons (it was a leftover in the original patchset actually).
This fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit b003fc0d8aa5e7060dbf7e5862b8013c73857c7f)
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw/9pfs')
| -rw-r--r-- | hw/9pfs/9p-local.c | 2 | ||||
| -rw-r--r-- | hw/9pfs/9p-util.h | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index f282bb7d66..227de61aa4 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -961,7 +961,7 @@ static int local_unlinkat_common(FsContext *ctx, int dirfd, const char *name, if (flags == AT_REMOVEDIR) { int fd; - fd = openat(dirfd, name, O_RDONLY | O_DIRECTORY | O_PATH); + fd = openat_dir(dirfd, name); if (fd == -1) { goto err_out; } diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h index cb7b2072d3..517027c520 100644 --- a/hw/9pfs/9p-util.h +++ b/hw/9pfs/9p-util.h @@ -27,7 +27,8 @@ static inline int openat_dir(int dirfd, const char *name) #else #define OPENAT_DIR_O_PATH 0 #endif - return openat(dirfd, name, O_DIRECTORY | O_RDONLY | OPENAT_DIR_O_PATH); + return openat(dirfd, name, + O_DIRECTORY | O_RDONLY | O_NOFOLLOW | OPENAT_DIR_O_PATH); } static inline int openat_file(int dirfd, const char *name, int flags, |