回合上游社区补丁,补丁数量：2-audit-AtomGit

已关闭

回合上游社区补丁,补丁数量：2 #64

peulerosci创建于 3月16日关闭于 3月23日

peulerosci

3月16日创建

优先级:

次要

原因分析:

【是否新引入rpm包，是否进行了安全编译选项扫描】

否

【定位分析】

回合社区补丁

软件包	CommitId	描述
openEuler:audit	c9d23011a36d4d439034cd47a66af6809b550ab3	Harden against a couple memory issues Hardened plist_append to free the freshly allocated node when duplicating the plugin configuration fails, avoiding a dangling pointer assignment. Updated cleanup_event to respect the optional event_is_prealloc hook before freeing events, preventing accidental frees of pooled objects. struct audit_message embeds a netlink header followed by a fixed-size payload buffer, so copying more than sizeof, so the layout expected by the historical macros is preserved while giving the analyzer an obvious bound check. During a live reconfigure, the new settings structure is torn down once the merge finishes. If we simply assigned oconf->plugin_dir = nconf->plugin_dir, the old configuration would wind up pointing at memory that destroy_config later frees, which is exactly what Coverity warned about. The revised code duplicates any new path into storage owned by the running configuration, frees the superseded value, and clears whichever pointer the temporary configuration no longer owns so the final cleanup cannot free it twice.That removes the aliasing path Coverity described. Bad-login reporting used to stuff whatever pointer auparse returned into a temporary stack lnode and then pass it to report_session, which blindly printed term+5 when the name started with /dev/. If term was the short literal ?, advancing five bytes ran off the end of the two-byte buffer Coverity modeled. The new logic normalizes the pointer before printing—falling back to ? when the field is missing and only skipping the /dev/ prefix when the string is actually long enough—so nothing dereferences past the available characters.

否

【是否修改引入】

二、缺陷分析结构反馈
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

peulerosci

3月16日评论：

@xuraoqing

openeuler-ci-bot成员

3月16日修改了issue 的描述

openeuler-ci-bot成员

3月16日添加了label：sig/sig-security-facility

openeuler-ci-bot成员

3月16日评论：

Welcome To openEuler Community

Hey @peulerosci , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: sig-security-facility ,
and any of the maintainers: @mailofzxf, @robertosassu, @zhujianwei001 ,

openeuler-ci-bot成员

3月16日评论：

以下的要求不是强制性的, 未按模板评论时对issue无任何影响
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, 缺陷严重等级, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后defect-manager将无法正常解析填写内容.
评论区可能使用到的指令说明: