[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 25/36] usb-mtp: use O_NOFOLLOW and O_CLOEXEC.
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 25/36] usb-mtp: use O_NOFOLLOW and O_CLOEXEC. |
Date: |
Tue, 23 Jul 2019 12:00:53 -0500 |
From: Gerd Hoffmann <address@hidden>
Open files and directories with O_NOFOLLOW to avoid symlinks attacks.
While being at it also add O_CLOEXEC.
usb-mtp only handles regular files and directories and ignores
everything else, so users should not see a difference.
Because qemu ignores symlinks, carrying out a successful symlink attack
requires swapping an existing file or directory below rootdir for a
symlink and winning the race against the inotify notification to qemu.
Fixes: CVE-2018-16872
Cc: Prasad J Pandit <address@hidden>
Cc: Bandan Das <address@hidden>
Reported-by: Michael Hanselmann <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Michael Hanselmann <address@hidden>
Message-id: address@hidden
(cherry picked from commit bab9df35ce73d1c8e19a37e2737717ea1c984dc1)
Signed-off-by: Michael Roth <address@hidden>
---
hw/usb/dev-mtp.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 100b7171f4..36c43b8c20 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -653,13 +653,18 @@ static void usb_mtp_object_readdir(MTPState *s, MTPObject
*o)
{
struct dirent *entry;
DIR *dir;
+ int fd;
if (o->have_children) {
return;
}
o->have_children = true;
- dir = opendir(o->path);
+ fd = open(o->path, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
+ if (fd < 0) {
+ return;
+ }
+ dir = fdopendir(fd);
if (!dir) {
return;
}
@@ -1007,7 +1012,7 @@ static MTPData *usb_mtp_get_object(MTPState *s,
MTPControl *c,
trace_usb_mtp_op_get_object(s->dev.addr, o->handle, o->path);
- d->fd = open(o->path, O_RDONLY);
+ d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
if (d->fd == -1) {
usb_mtp_data_free(d);
return NULL;
@@ -1031,7 +1036,7 @@ static MTPData *usb_mtp_get_partial_object(MTPState *s,
MTPControl *c,
c->argv[1], c->argv[2]);
d = usb_mtp_data_alloc(c);
- d->fd = open(o->path, O_RDONLY);
+ d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
if (d->fd == -1) {
usb_mtp_data_free(d);
return NULL;
@@ -1658,7 +1663,7 @@ static void usb_mtp_write_data(MTPState *s)
0, 0, 0, 0);
goto done;
}
- d->fd = open(path, O_CREAT | O_WRONLY, mask);
+ d->fd = open(path, O_CREAT | O_WRONLY | O_CLOEXEC | O_NOFOLLOW, mask);
if (d->fd == -1) {
usb_mtp_queue_result(s, RES_STORE_FULL, d->trans,
0, 0, 0, 0);
--
2.17.1
- [Qemu-devel] [PATCH 13/36] hw/rdma: another clang compilation fix, (continued)
- [Qemu-devel] [PATCH 13/36] hw/rdma: another clang compilation fix, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 10/36] tpm: Make sure new locality passed to tpm_tis_prep_abort() is valid, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 17/36] i386: remove the new CPUID 'PCONFIG' from Icelake-Server CPU model, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 18/36] i386: remove the 'INTEL_PT' CPUID bit from named CPU models, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 15/36] tpm_tis: fix loop that cancels any seizure by a lower locality, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 16/36] vfio-ap: flag as compatible with balloon, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 20/36] qga-win: include glib when building VSS DLL, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 19/36] json: Fix % handling when not interpolating, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 21/36] configure: improve usbfs check, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 27/36] qcow2: Avoid COW during metadata preallocation, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 25/36] usb-mtp: use O_NOFOLLOW and O_CLOEXEC.,
Michael Roth <=
- [Qemu-devel] [PATCH 28/36] cutils: Fix size_to_str() on 32-bit platforms, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 29/36] block: Fix AioContext switch for bs->drv == NULL, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 24/36] qga: update docs with systemd suspend support info, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 14/36] slirp: check sscanf result when emulating ident, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 26/36] qemu-img: fix error reporting for -object, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 30/36] do not call vhost_net_cleanup() on running net from char user event, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 01/36] i2c: Move typedef of bitbang_i2c_interface to i2c.h, Michael Roth, 2019/07/23
- [Qemu-devel] [PATCH 22/36] mac_oldworld: use node name instead of alias name for hd device in FWPathProvider, Michael Roth, 2019/07/23