mirror of
git://git.yoctoproject.org/poky
synced 2026-09-02 22:07:12 +00:00
3c6a02f04a
Upstream Repository: https://git.savannah.gnu.org/git/dmidecode.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30630 Type: Security Fix CVE: CVE-2023-30630 Score: 7.8 Patch: https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c (From OE-Core rev: f3def5af120355a2454c088724e147bbce785d1b) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
63 lines
1.8 KiB
Diff
63 lines
1.8 KiB
Diff
From b7dacccff32294ea522df32a9391d0218e7600ea Mon Sep 17 00:00:00 2001
|
|
From: Jean Delvare <jdelvare@suse.de>
|
|
Date: Mon, 20 Feb 2023 14:53:31 +0100
|
|
Subject: [PATCH] dmidecode: Do not let --dump-bin overwrite an existing file
|
|
|
|
Make sure that the file passed to option --dump-bin does not already
|
|
exist. In practice, it is rather unlikely that an honest user would
|
|
want to overwrite an existing dump file, while this possibility
|
|
could be used by a rogue user to corrupt a system file.
|
|
|
|
CVE: CVE-2023-30630
|
|
Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c]
|
|
|
|
Backport Changes:
|
|
- Ignored changes in man/dmidecode.8 file.
|
|
|
|
Signed-off-by: Jean Delvare <jdelvare@suse.de>
|
|
Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>
|
|
(cherry picked from commit 6ca381c1247c81f74e1ca4e7706f70bdda72e6f2)
|
|
Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com>
|
|
|
|
---
|
|
dmidecode.c | 14 ++++++++++++--
|
|
1 file changed, 12 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/dmidecode.c b/dmidecode.c
|
|
index b91e53b..846d9a1 100644
|
|
--- a/dmidecode.c
|
|
+++ b/dmidecode.c
|
|
@@ -60,6 +60,7 @@
|
|
* https://www.dmtf.org/sites/default/files/DSP0270_1.0.1.pdf
|
|
*/
|
|
|
|
+#include <fcntl.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <strings.h>
|
|
@@ -5097,13 +5098,22 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver
|
|
static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table,
|
|
u32 table_len)
|
|
{
|
|
+ int fd;
|
|
FILE *f;
|
|
|
|
- f = fopen(opt.dumpfile, "wb");
|
|
+ fd = open(opt.dumpfile, O_WRONLY|O_CREAT|O_EXCL, 0666);
|
|
+ if (fd == -1)
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("open");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ f = fdopen(fd, "wb");
|
|
if (!f)
|
|
{
|
|
fprintf(stderr, "%s: ", opt.dumpfile);
|
|
- perror("fopen");
|
|
+ perror("fdopen");
|
|
return -1;
|
|
}
|
|
|