Skip to content
This repository has been archived by the owner on Aug 6, 2020. It is now read-only.

v239-security: fix of CVE-2019-6454 #26

Merged
merged 3 commits into from Feb 19, 2019

Conversation

andir
Copy link
Member

@andir andir commented Feb 19, 2019

Updates for the issue(s) mentioned in https://www.openwall.com/lists/oss-security/2019/02/18/3.

I have a NixOS test locally that can be used to verify before / after patching. If interested contact me.

Riccardo Schirone and others added 3 commits February 19, 2019 16:39
Even though the dbus specification does not enforce any length limit on the
path of a dbus message, having to analyze too long strings in PID1 may be
time-consuming and it may have security impacts.

In any case, the limit is set so high that real-life applications should not
have a problem with it.

(cherry picked from commit 61397a6)
Paths are limited to BUS_PATH_SIZE_MAX but the maximum size is anyway too big
to be allocated on the stack, so let's switch to the heap where there is a
clear way to understand if the allocation fails.

(cherry picked from commit f519a19)
dbus-daemon might have a slightly different idea of what a valid msg is
than us (for example regarding valid msg and field sizes). Let's hence
try to proceed if we can and thus drop messages rather than fail the
connection if we fail to validate a message.

Hopefully the differences in what is considered valid are not visible
for real-life usecases, but are specific to exploit attempts only.

(cherry picked from commit 6d586a1)
@fpletz fpletz merged commit 6bcb844 into NixOS:nixos-v239-security Feb 19, 2019
@andir andir deleted the nixos-v239-security branch February 19, 2019 22:10
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
3 participants