enlightenment/enlightenment
enlightenment
/
enlightenment
10
9
Fork 12
Code Issues 24 Pull Requests 2 Projects Releases Wiki Activity

enlightenment_sys - fix security hole CVE-2022-37706 

https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit

fixes that.
@fix
This commit is contained in:
Carsten Haitzler 2022-09-15 14:38:21 +01:00
parent 576d29a809
commit e87530514e
1 changed files with 61 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
src/bin/e_sys_main.c
View File

@ -358,6 +358,19 @@ main(int argc,
/* local subsystem functions */ /* local subsystem functions */
#ifdef HAVE_EEZE_MOUNT #ifdef HAVE_EEZE_MOUNT
static Eina_Bool
check_is_num_to_comma(const char *s)
{
const char *p;
for (p = s; *p && (*p != ','); p++)
{
if (!((*p >= '0') && (*p <= '9'))) return EINA_FALSE;
}
return EINA_TRUE;
}
static Eina_Bool static Eina_Bool
mountopts_check(const char *opts) mountopts_check(const char *opts)
{ {
@ -400,6 +413,8 @@ mountopts_check(const char *opts)
{ {
p += 4; p += 4;
errno = 0; errno = 0;
if (!check_is_num_to_comma(p)) return EINA_FALSE;
muid = strtoul(p, &end, 10); muid = strtoul(p, &end, 10);
if (muid == ULONG_MAX) return EINA_FALSE; if (muid == ULONG_MAX) return EINA_FALSE;
if (errno) return EINA_FALSE; if (errno) return EINA_FALSE;
@ -414,13 +429,53 @@ mountopts_check(const char *opts)
return EINA_TRUE; return EINA_TRUE;
} }
static Eina_Bool
check_is_alpha_num(char c)
{
if (((c >= '0') && (c <= '9')) ||
((c >= 'a') && (c <= 'z')) ||
((c >= 'A') && (c <= 'Z'))) return EINA_TRUE;
return EINA_FALSE;
}
static Eina_Bool static Eina_Bool
check_uuid(const char *uuid) check_uuid(const char *uuid)
{ {
const char *p; const char *p;
for (p = uuid; p[0]; p++) for (p = uuid; p[0]; p++)
if ((!isalnum(*p)) && (*p != '-')) return EINA_FALSE; {
if ((!check_is_alpha_num(*p)) && (*p != '-')) return EINA_FALSE;
}
return EINA_TRUE;
}
static Eina_Bool
check_sane_path(const char *path)
{
const char *forbidden_ch = "`~!#$%^&*()[]{}|\\;'\"<>?";
const char *p;
if (strstr(path, "..")) return EINA_FALSE; // just don't allow .. anywhere
for (p = forbidden_ch; *p; p++) // no invalid chars like above
{
if (strchr(path, *p)) return EINA_FALSE;
}
for (p = path; *p; p++) // nothing in lower ascii ctrl chars or high ascii
{
if ((*p <= ' ') || (*p >= 0x7f)) return EINA_FALSE;
}
return EINA_TRUE;
}
static Eina_Bool
check_sane_dev(const char *dev)
{
struct stat st;
if (strncmp(dev, "/dev/", 5)) return EINA_FALSE; // not a /dev file
if (!check_sane_path(dev)) return EINA_FALSE;
if (stat(dev, &st)) return EINA_FALSE; // must actually exist
return EINA_TRUE; return EINA_TRUE;
} }
@ -428,9 +483,9 @@ static Eina_Bool
mount_args_check(int argc, char **argv, const char *action) mount_args_check(int argc, char **argv, const char *action)
{ {
Eina_Bool opts = EINA_FALSE; Eina_Bool opts = EINA_FALSE;
struct stat st;
const char *node; const char *node;
char buf[PATH_MAX]; char buf[PATH_MAX];
struct stat st;
if (!strcmp(action, "mount")) if (!strcmp(action, "mount"))
{ {
@ -451,9 +506,9 @@ mount_args_check(int argc, char **argv, const char *action)
} }
else else
{ {
if (strncmp(argv[4], "/dev/", 5)) return EINA_FALSE; if (!check_sane_dev(argv[4])) return EINA_FALSE;
if (stat(argv[4], &st)) return EINA_FALSE;
} }
if (!check_sane_path(argv[5])) return EINA_FALSE;
node = strrchr(argv[5], '/'); node = strrchr(argv[5], '/');
if (!node) return EINA_FALSE; if (!node) return EINA_FALSE;
@ -468,8 +523,7 @@ mount_args_check(int argc, char **argv, const char *action)
/path/to/umount /dev/$devnode /path/to/umount /dev/$devnode
*/ */
if (argc != 3) return EINA_FALSE; if (argc != 3) return EINA_FALSE;
if (strncmp(argv[2], "/dev/", 5)) return EINA_FALSE; if (!check_sane_dev(argv[2])) return EINA_FALSE;
if (stat(argv[2], &st)) return EINA_FALSE;
node = strrchr(argv[2], '/'); node = strrchr(argv[2], '/');
if (!node) return EINA_FALSE; if (!node) return EINA_FALSE;
if (!node[1]) return EINA_FALSE; if (!node[1]) return EINA_FALSE;
@ -488,8 +542,7 @@ mount_args_check(int argc, char **argv, const char *action)
/path/to/eject /dev/$devnode /path/to/eject /dev/$devnode
*/ */
if (argc != 3) return EINA_FALSE; if (argc != 3) return EINA_FALSE;
if (strncmp(argv[2], "/dev/", 5)) return EINA_FALSE; if (!check_sane_dev(argv[2])) return EINA_FALSE;
if (stat(argv[2], &st)) return EINA_FALSE;
node = strrchr(argv[2], '/'); node = strrchr(argv[2], '/');
if (!node) return EINA_FALSE; if (!node) return EINA_FALSE;
if (!node[1]) return EINA_FALSE; if (!node[1]) return EINA_FALSE;