Messages in this thread | | | Date | Fri, 5 May 2006 07:37:18 +0200 | From | Willy Tarreau <> | Subject | Re: [PATCH] smbfs chroot issue (CVE-2006-1864) |
| |
Marcelo,
This patch also applies to 2.4, did you receive it on your side or do you want me to queue it in -upstream ?
Regards, Willy
On Thu, May 04, 2006 at 06:40:41PM -0700, Chris Wright wrote: > From: Olaf Kirch <okir@suse.de> > > Mark Moseley reported that a chroot environment on a SMB share can be > left via "cd ..\\". Similar to CVE-2006-1863 issue with cifs, this fix > is for smbfs. > > Steven French <sfrench@us.ibm.com> wrote: > > Looks fine to me. This should catch the slash on lookup or equivalent, > which will be all obvious paths of interest. > > Signed-off-by: Chris Wright <chrisw@sous-sol.org> > --- > This fix is in -stable, but doesn't appear to be in your tree yet. > > fs/smbfs/dir.c | 5 +++++ > 1 file changed, 5 insertions(+) > > --- linus-2.6.orig/fs/smbfs/dir.c > +++ linus-2.6/fs/smbfs/dir.c > @@ -434,6 +434,11 @@ smb_lookup(struct inode *dir, struct den > if (dentry->d_name.len > SMB_MAXNAMELEN) > goto out; > > + /* Do not allow lookup of names with backslashes in */ > + error = -EINVAL; > + if (memchr(dentry->d_name.name, '\\', dentry->d_name.len)) > + goto out; > + > lock_kernel(); > error = smb_proc_getattr(dentry, &finfo); > #ifdef SMBFS_PARANOIA > - > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |