gnu: polkit: Add replacement for CVE-2021-3560.

* gnu/packages/patches/polkit-CVE-2021-3560.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/polkit.scm (polkit/fixed): New variable.
(polkit)[replacement]: New field.
This commit is contained in:
Ludovic Courtès 2021-06-08 10:43:10 +02:00
parent 7ccf416dd0
commit 9178566954
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
3 changed files with 30 additions and 0 deletions

View file

@ -1555,6 +1555,7 @@ dist_patch_DATA = \
%D%/packages/patches/plib-CVE-2011-4620.patch \
%D%/packages/patches/plib-CVE-2012-4552.patch \
%D%/packages/patches/plotutils-spline-test.patch \
%D%/packages/patches/polkit-CVE-2021-3560.patch \
%D%/packages/patches/portaudio-audacity-compat.patch \
%D%/packages/patches/portmidi-modular-build.patch \
%D%/packages/patches/postgresql-disable-resolve_symlinks.patch \

View file

@ -0,0 +1,21 @@
This patch fixes CVE-2021-3560, "local privilege escalation using
polkit_system_bus_name_get_creds_sync()":
https://www.openwall.com/lists/oss-security/2021/06/03/1
Patch from <https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a>.
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
index 8daa12cb9093c1d765c7b83654a2b8d0d382378e..8ed13631508dd96624898df90ee2ece4dcf3e1e5 100644
--- a/src/polkit/polkitsystembusname.c
+++ b/src/polkit/polkitsystembusname.c
@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
g_main_context_iteration (tmp_context, TRUE);
+ if (data.caught_error)
+ goto out;
+
if (out_uid)
*out_uid = data.uid;
if (out_pid)

View file

@ -44,6 +44,7 @@ (define-public polkit
(package
(name "polkit")
(version "0.116")
(replacement polkit/fixed)
(source (origin
(method url-fetch)
(uri (string-append
@ -135,6 +136,13 @@ (define-public polkit
for unprivileged applications.")
(license lgpl2.0+)))
(define polkit/fixed
(package
(inherit polkit)
(source (origin
(inherit (package-source polkit))
(patches (search-patches "polkit-CVE-2021-3560.patch"))))))
(define-public polkit-qt
(package
(name "polkit-qt")