已开启
fix: sftp path control - lsetstat bypass #438
u011145029创建于 7月8日
fix: sftp path control - lsetstat bypass #438
已开启
共 2 个文件变更+29-1
| @@ -0,0 +1,20 @@ | |||
| 1 | +diff --git a/sftp-server.c b/sftp-server.c | ||
| 2 | +index b89b157..a1d411a 100644 | ||
| 3 | +--- a/sftp-server.c | ||
| 4 | ++++ b/sftp-server.c | ||
| 5 | + process_extended_lsetstat(u_int32_t id) | ||
| 6 | + (r = decode_attrib(iqueue, &a)) != 0) | ||
| 7 | + fatal_fr(r, "parse"); | ||
| 8 | + | ||
| 9 | ++ /* add begin: fix lsetstat path permission bypass */ | ||
| 10 | ++ if (RETURN_OK != path_permition_check(name, FLAG_PROTECTDIR)) | ||
| 11 | ++ { | ||
| 12 | ++ send_status(id, SSH2_FX_PERMISSION_DENIED); | ||
| 13 | ++ free(name); | ||
| 14 | ++ return; | ||
| 15 | ++ } | ||
| 16 | ++ /* add end */ | ||
| 17 | ++ | ||
| 18 | + debug("request %u: lsetstat name \"%s\"", id, name); | ||
| 19 | + if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { | ||
| 20 | + /* nonsensical for links */ | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | %{?no_gtk2:%global gtk2 0} | 6 | %{?no_gtk2:%global gtk2 0} |
| 7 | 7 | ||
| 8 | %global sshd_uid 74 | 8 | %global sshd_uid 74 |
| 9 | -%global openssh_release 15 | 9 | +%global openssh_release 16 |
| 10 | 10 | ||
| 11 | Name: openssh | 11 | Name: openssh |
| 12 | Version: 9.6p1 | 12 | Version: 9.6p1 |
| @@ -150,6 +150,7 @@ Patch109: backport-fix-CVE-2026-35386.patch | |||
| 150 | Patch110: backport-fix-CVE-2026-35387.patch | 150 | Patch110: backport-fix-CVE-2026-35387.patch |
| 151 | Patch111: backport-fix-CVE-2026-35388.patch | 151 | Patch111: backport-fix-CVE-2026-35388.patch |
| 152 | Patch112: adaption-for-feature-sm2-support.patch | 152 | Patch112: adaption-for-feature-sm2-support.patch |
| 153 | +Patch113: fix-sftp-path-control-lsetstat-bypass.patch | ||
| 153 | 154 | ||
| 154 | Requires: /sbin/nologin | 155 | Requires: /sbin/nologin |
| 155 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 | 156 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 |
| @@ -386,6 +387,7 @@ popd | |||
| 386 | %patch -P 110 -p1 | 387 | %patch -P 110 -p1 |
| 387 | %patch -P 111 -p1 | 388 | %patch -P 111 -p1 |
| 388 | %patch -P 112 -p1 | 389 | %patch -P 112 -p1 |
| 390 | +%patch -P 113 -p1 | ||
| 389 | 391 | ||
| 390 | autoreconf | 392 | autoreconf |
| 391 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 | 393 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 |
| @@ -617,6 +619,12 @@ fi | |||
| 617 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* | 619 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
| 618 | 620 | ||
| 619 | %changelog | 621 | %changelog |
| 622 | +* Wed Jul 8 2026 liuming<liuming@kylinos.cn> - 9.6p1-16 | ||
| 623 | +- Type:bugfix | ||
| 624 | +- CVE:NA | ||
| 625 | +- SUG:NA | ||
| 626 | +- DESC:fix lsetstat perm bypass | ||
| 627 | + | ||
| 620 | * Sat May 9 2026 zhangbinqin<zhangbinqin@h-partners.com> - 9.6p1-15 | 628 | * Sat May 9 2026 zhangbinqin<zhangbinqin@h-partners.com> - 9.6p1-15 |
| 621 | - Type:bugfix | 629 | - Type:bugfix |
| 622 | - CVE:NA | 630 | - CVE:NA |