aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-extended/glusterfs/files/0003-server-protocol-don-t-allow-.-path-in-name.patch
blob: e6ef9e39eb5a967b73be80b15a1ed70279471ff2 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
From b89658672d137ef56bd0694457b9125bf7d45ba4 Mon Sep 17 00:00:00 2001
From: Amar Tumballi <amarts@redhat.com>
Date: Thu, 9 Aug 2018 13:00:01 +0530
Subject: [PATCH 3/7] server-protocol: don't allow '../' path in 'name'

This will prevent any arbitrary file creation through glusterfs
by modifying the client bits.

Also check for the similar flaw inside posix too, so we prevent any
changes in layers in-between.

Fixes: bz#1625095

Signed-off-by: Amar Tumballi <amarts@redhat.com>
Change-Id: Id9fe0ef6e86459e8ed85ab947d977f058c5ae06e

Upstream-Status: Backport

Fix CVE-2018-10926
Fix CVE-2018-10927
Fix CVE-2018-10928
Fix CVE-2018-10929
Fix CVE-2018-10930

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 xlators/protocol/server/src/server-resolve.c | 12 ++++++++++++
 xlators/storage/posix/src/posix-handle.h     |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/xlators/protocol/server/src/server-resolve.c b/xlators/protocol/server/src/server-resolve.c
index d0126aa..aa35685 100644
--- a/xlators/protocol/server/src/server-resolve.c
+++ b/xlators/protocol/server/src/server-resolve.c
@@ -294,6 +294,18 @@ resolve_entry_simple (call_frame_t *frame)
         /* expected @parent was found from the inode cache */
         gf_uuid_copy (state->loc_now->pargfid, resolve->pargfid);
         state->loc_now->parent = inode_ref (parent);
+
+        if (strstr (resolve->bname, "../")) {
+                /* Resolving outside the parent's tree is not allowed */
+                gf_msg (this->name, GF_LOG_ERROR, EPERM,
+                        PS_MSG_GFID_RESOLVE_FAILED,
+                        "%s: path sent by client not allowed",
+                        resolve->bname);
+                resolve->op_ret   = -1;
+                resolve->op_errno = EPERM;
+                ret = 1;
+                goto out;
+        }
         state->loc_now->name = resolve->bname;
 
         inode = inode_grep (state->itable, parent, resolve->bname);
diff --git a/xlators/storage/posix/src/posix-handle.h b/xlators/storage/posix/src/posix-handle.h
index 9af6a7a..6e7a8d2 100644
--- a/xlators/storage/posix/src/posix-handle.h
+++ b/xlators/storage/posix/src/posix-handle.h
@@ -217,6 +217,12 @@
                 break;                                                  \
         }                                                               \
                                                                         \
+        if (strstr (loc->name, "../")) {                                \
+                gf_msg (this->name, GF_LOG_ERROR, 0, P_MSG_ENTRY_HANDLE_CREATE, \
+                        "'../' in name not allowed: (%s)", loc->name); \
+                op_ret = -1;                                            \
+                break;                                                  \
+        }                                                               \
         if (LOC_HAS_ABSPATH (loc)) {                                    \
                 MAKE_REAL_PATH (entp, this, loc->path);                 \
                 __parp = strdupa (entp);                                \
-- 
2.7.4