OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

9pfs: local: statfs: don't follow symlinks

Browse Source 
The local_statfs() callback is vulnerable to symlink attacks because it
calls statfs() which follows symbolic links in all path elements.

This patch converts local_statfs() to rely on open_nofollow() and fstatfs()
instead.

This partly fixes CVE-2016-9602.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Greg Kurz 2017-02-26 23:43:25 +01:00
parent a33eda0dd9
commit 31e51d1c15
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hw/9pfs/9p-local.c
View File

@ -1077,13 +1077,11 @@ static int local_fsync(FsContext *ctx, int fid_type,
static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf)
{
char *buffer;
int ret;
char *path = fs_path->data;
int fd, ret;
buffer = rpath(s, path);
ret = statfs(buffer, stbuf);
g_free(buffer);
fd = local_open_nofollow(s, fs_path->data, O_RDONLY, 0);
ret = fstatfs(fd, stbuf);
close_preserve_errno(fd);
return ret;
}