packages/libcap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!70 fix CVE-2025-1390

Browse Source 
From: @Linux_zhang2024 
Reviewed-by: @HuaxinLuGitee 
Signed-off-by: @zgzxx, @HuaxinLuGitee
This commit is contained in:
openeuler-ci-bot 2025-03-04 08:22:46 +00:00 committed by Gitee
commit efdfa20ae4
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
backport-CVE-2025-1390-pam_cap-Fix-potential-configuration-parsing-error.patch Normal file
View File

@ -0,0 +1,32 @@
From 1ad42b66c3567481cc5fa22fc1ba1556a316d878 Mon Sep 17 00:00:00 2001
From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Date: Mon, 17 Feb 2025 10:31:55 +0800
Subject: [PATCH] pam_cap: Fix potential configuration parsing error
The current configuration parsing does not actually skip user names
that do not start with @, but instead treats the name as a group
name for further parsing, which can result in matching unexpected
capability sets and may trigger potential security issues. Only
names starting with @ should be parsed as group names.
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
---
pam_cap/pam_cap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c
index 24de329..3ec99bb 100644
--- a/pam_cap/pam_cap.c
+++ b/pam_cap/pam_cap.c
@@ -166,6 +166,7 @@ static char *read_capabilities_for_user(const char *user, const char *source)
if (line[0] != '@') {
D(("user [%s] is not [%s] - skipping", user, line));
+ continue;
}
int i;
--
2.33.0

6
libcap.spec
View File

@ -1,6 +1,6 @@
Name: libcap
Version: 2.32
Release: 7
Release: 8
Summary: A library for getting and setting POSIX.1e draft 15 capabilities
License: GPLv2
URL: https://sites.google.com/site/fullycapable
@ -15,6 +15,7 @@ Patch5: backport-Guarantee-sufficient-memory-for-scratch-pathname.patch
Patch6: backport-getpcaps-catch-PID-parsing-errors.patch
Patch7: backport-Large-strings-can-confuse-libcap-s-internal-strdup-c.patch
Patch8: backport-libcap-Ensure-the-XATTR_NAME_CAPS-is-define.patch
Patch9: backport-CVE-2025-1390-pam_cap-Fix-potential-configuration-parsing-error.patch
BuildRequires: libattr-devel pam-devel perl-interpreter gcc
@ -75,6 +76,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.*
%{_mandir}/man8/*.gz
%changelog
* Tue Mar 04 2025 Linux_zhang <zhangruifang@h-partners.com> - 2.32-8
- fix CVE-2025-1390
* Mon Jul 3 2023 wangyunjia <yunjia.wang@huawei.com> - 2.32-7
- VFS_CAP_U32 can not ensure that XATTR_NAME_CAPS is defined, and failed to build