From d7f24f954e4c6420e252064cbe512f79231a263c Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Wed, 17 May 2017 13:59:59 +0200 Subject: [PATCH] Import Debian changes 1:4.4-4.1 shadow (1:4.4-4.1) unstable; urgency=high * Non-maintainer upload. * Reset pid_child only if waitpid was successful. This is a regression fix for CVE-2017-2616. If su receives a signal like SIGTERM, it is not propagated to the child. (Closes: #862806) --- .gitignore | 1 + debian/changelog | 9 ++++++ ...child-only-if-waitpid-was-successful.patch | 29 +++++++++++++++++++ debian/patches/series | 2 ++ 4 files changed, 41 insertions(+) create mode 100644 debian/patches/301-Reset-pid_child-only-if-waitpid-was-successful.patch diff --git a/.gitignore b/.gitignore index 743e3d73..960696cd 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,7 @@ lib*.a .deps .libs +*.patch *.rej *.orig diff --git a/debian/changelog b/debian/changelog index be0028d8..b9d894dc 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +shadow (1:4.4-4.1) unstable; urgency=high + + * Non-maintainer upload. + * Reset pid_child only if waitpid was successful. + This is a regression fix for CVE-2017-2616. If su receives a signal like + SIGTERM, it is not propagated to the child. (Closes: #862806) + + -- Salvatore Bonaccorso Wed, 17 May 2017 13:59:59 +0200 + shadow (1:4.4-4) unstable; urgency=high * su: properly clear child PID (CVE-2017-2616) (Closes: #855943) diff --git a/debian/patches/301-Reset-pid_child-only-if-waitpid-was-successful.patch b/debian/patches/301-Reset-pid_child-only-if-waitpid-was-successful.patch new file mode 100644 index 00000000..64aeb341 --- /dev/null +++ b/debian/patches/301-Reset-pid_child-only-if-waitpid-was-successful.patch @@ -0,0 +1,29 @@ +From 7d82f203eeec881c584b2fa06539b39e82985d97 Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Sun, 14 May 2017 17:58:10 +0200 +Subject: [PATCH] Reset pid_child only if waitpid was successful. + +Do not reset the pid_child to 0 if the child process is still +running. This else-condition can be reached with pid being -1, +therefore explicitly test this condition. + +This is a regression fix for CVE-2017-2616. If su receives a +signal like SIGTERM, it is not propagated to the child. + +Reported-by: Radu Duta +Signed-off-by: Tobias Stoeckmann +--- + src/su.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/su.c ++++ b/src/su.c +@@ -363,7 +363,7 @@ static void prepare_pam_close_session (v + /* wake child when resumed */ + kill (pid, SIGCONT); + stop = false; +- } else { ++ } else if ( (pid_t)-1 != pid) { + pid_child = 0; + } + } while (!stop); diff --git a/debian/patches/series b/debian/patches/series index 553c190b..d2bff0e2 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -6,6 +6,8 @@ 0006-French-manpage-translation.patch 0007-Fix-some-spelling-issues-in-the-Norwegian-translatio.patch 0008-su-properly-clear-child-PID.patch +301-Reset-pid_child-only-if-waitpid-was-successful.patch + # These patches are only for the testsuite: #900_testsuite_groupmems #901_testsuite_gcov