diff options
| author | Greg Kurz <groug@kaod.org> | 2017-02-26 23:42:26 +0100 |
|---|---|---|
| committer | Greg Kurz <groug@kaod.org> | 2017-02-28 11:21:15 +0100 |
| commit | 56ad3e54dad6cdcee8668d170df161d89581846f (patch) | |
| tree | 1408dc37298a3c74d867820793ecfc8fd0dfa317 /hw/9pfs/9p-util.h | |
| parent | 996a0d76d7e756e4023ef79bc37bfe629b9eaca7 (diff) | |
| download | qemu-56ad3e54dad6cdcee8668d170df161d89581846f.zip qemu-56ad3e54dad6cdcee8668d170df161d89581846f.tar.gz qemu-56ad3e54dad6cdcee8668d170df161d89581846f.tar.bz2 | |
9pfs: local: lgetxattr: don't follow symlinks
The local_lgetxattr() callback is vulnerable to symlink attacks because
it calls lgetxattr() which follows symbolic links in all path elements but
the rightmost one.
This patch introduces a helper to emulate the non-existing fgetxattrat()
function: it is implemented with /proc/self/fd which provides a trusted
path that can be safely passed to lgetxattr().
local_lgetxattr() is converted to use this helper and opendir_nofollow().
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/9pfs/9p-util.h')
| -rw-r--r-- | hw/9pfs/9p-util.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h index e80b5a5..676641f 100644 --- a/hw/9pfs/9p-util.h +++ b/hw/9pfs/9p-util.h @@ -46,5 +46,7 @@ static inline int openat_file(int dirfd, const char *name, int flags, int relative_openat_nofollow(int dirfd, const char *path, int flags, mode_t mode); +ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name, + void *value, size_t size); #endif |