mirror of
https://git.freebsd.org/ports.git
synced 2025-04-29 10:06:40 -04:00
7671dd5ccb
Fix three security issues in security/trousers: * CVE-2020-24332 If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks * CVE-2020-24330 If the tcsd daemon is started with root privileges, it fails to drop the root gid after it is no longer needed * CVE-2020-24331 If the tcsd daemon is started with root privileges, the tss user has read and write access to the /etc/tcsd.conf file Add patches to fix potential use-after-free Fix build with -fno-common MFH: 2020Q3 Security: e37a0a7b-e1a7-11ea-9538-0c9d925bbbc0
41 lines
1.3 KiB
C
41 lines
1.3 KiB
C
commit 10b33821cfd79375cfdbe05123b2f7f6329eac3e
|
|
Author: Jerry Snitselaar <jsnitsel@redhat.com>
|
|
Date: Wed Jan 16 14:00:43 2019 -0700
|
|
|
|
trousers: clean up use after free in Transport_TerminateHandle
|
|
|
|
Clean up possible use after free. The value of the handles pointer
|
|
may change, but if it doesn't then free is being called twice on
|
|
the same address.
|
|
|
|
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
|
|
|
|
diff --git src/tspi/tsp_auth.c src/tspi/tsp_auth.c
|
|
index d538079..5a97e6e 100755
|
|
--- src/tspi/tsp_auth.c
|
|
+++ src/tspi/tsp_auth.c
|
|
@@ -1221,17 +1221,17 @@ Transport_TerminateHandle(TSS_HCONTEXT tspContext, /* in */
|
|
}
|
|
|
|
*handles = handle;
|
|
- handles_track = handles;
|
|
+ handles_track = handles;
|
|
|
|
- // Since the call tree of this function can possibly alloc memory
|
|
- // (check RPC_ExecuteTransport_TP function), its better to keep track of
|
|
- // the handle.
|
|
+ // Since the call tree of this function can possibly alloc memory
|
|
+ // (check RPC_ExecuteTransport_TP function), its better to keep track of
|
|
+ // the handle.
|
|
result = obj_context_transport_execute(tspContext, TPM_ORD_Terminate_Handle, 0, NULL,
|
|
NULL, &handlesLen, &handles, NULL, NULL, NULL, NULL);
|
|
|
|
- free(handles);
|
|
- handles = NULL;
|
|
- free(handles_track);
|
|
+ if (handles != handles_track)
|
|
+ free(handles);
|
|
+ free(handles_track);
|
|
|
|
return result;
|
|
}
|