NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/openvmtools: fix CVE-2022-31676

Browse Source 
Add a patch for CVE-2022-31676 (local privilege escalation
vulnerability).

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Stefan Agner 2022-10-19 10:56:16 +02:00 committed by Thomas Petazzoni
parent 267188242e
commit b123e8887d
2 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
package/openvmtools/0013-Properly-check-authorization-on-incoming-guestOps-re.patch Normal file
View File

@ -0,0 +1,40 @@
From bb9f9ffbb151397545f921cee5b6a4933c6eea80 Mon Sep 17 00:00:00 2001
Message-Id: <bb9f9ffbb151397545f921cee5b6a4933c6eea80.1666169374.git.stefan@agner.ch>
From: John Wolfe <jwolfe@vmware.com>
Date: Wed, 10 Aug 2022 06:12:02 -0700
Subject: [PATCH] Properly check authorization on incoming guestOps requests
Fix public pipe request checks. Only a SessionRequest type should
be accepted on the public pipe.
Upstream: https://github.com/vmware/open-vm-tools/blob/CVE-2022-31676.patch/1205-Properly-check-authorization-on-incoming-guestOps-re.patch
Signed-off-by: Stefan Agner <stefan@agner.ch>
---
vgauth/serviceImpl/proto.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/vgauth/serviceImpl/proto.c b/vgauth/serviceImpl/proto.c
index db7159ee..c4f85b02 100644
--- a/vgauth/serviceImpl/proto.c
+++ b/vgauth/serviceImpl/proto.c
@@ -1,5 +1,5 @@
/*********************************************************
- * Copyright (C) 2011-2016,2019-2021 VMware, Inc. All rights reserved.
+ * Copyright (c) 2011-2016,2019-2022 VMware, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU Lesser General Public License as published
@@ -1201,6 +1201,10 @@ Proto_SecurityCheckRequest(ServiceConnection *conn,
VGAuthError err;
gboolean isSecure = ServiceNetworkIsConnectionPrivateSuperUser(conn);
+ if (conn->isPublic && req->reqType != PROTO_REQUEST_SESSION_REQ) {
+ return VGAUTH_E_PERMISSION_DENIED;
+ }
+
switch (req->reqType) {
/*
* This comes over the public connection; alwsys let it through.
--
2.38.0

3
package/openvmtools/openvmtools.mk
View File

@ -13,6 +13,9 @@ OPENVMTOOLS_LICENSE_FILES = COPYING
OPENVMTOOLS_CPE_ID_VENDOR = vmware
OPENVMTOOLS_CPE_ID_PRODUCT = tools
# 0013-Properly-check-authorization-on-incoming-guestOps-re.patch
OPENVMTOOLS_IGNORE_CVES += CVE-2022-31676
# configure.ac is patched
OPENVMTOOLS_AUTORECONF = YES
OPENVMTOOLS_CONF_OPTS = --with-dnet \