[notify] polkit: pulled upstream patch against CVE-2021-4034

3 files changed, 86 insertions, 4 deletions

diff --git a/polkit/.signature b/polkit/.signature
index 412587642..632215fbe 100644
--- a/polkit/.signature
+++ b/polkit/.signature
@@ -1,7 +1,8 @@
 untrusted comment: verify with /etc/ports/opt.pub
-RWSE3ohX2g5d/Rw84KMLAEMJnMuFubZf34af78qsvRl1zkkTMPDoh9RPPw4TXv70WixN6nNFYeXC+KWjS/EOQ7QnaSN/He6kHQE=
-SHA256 (Pkgfile) = c7e291ebf0f1f74582be59faeeabe2b661413b3587e90ff4d219827d0c78c9b4
+RWSE3ohX2g5d/V8l9iBDcPY09Je8xzkpyInqswb+VSyU6oV2Ysyhhp5EPQnUwnJuSi+ajKS5lXvvyHIMPtTVggBgb+h9CX5dUwQ=
+SHA256 (Pkgfile) = 728a668cb1422d14793379687a58314c10fffffc70bd920c1d328f402a78843c
 SHA256 (.footprint) = 7ae3e87d2e0379db60e118c5b79938e87319b3460d1907ef73524cbdad79db15
 SHA256 (polkit-0.120.tar.gz) = ee7a599a853117bf273548725719fa92fabd2f136915c7a4906cee98567aee03
 SHA256 (polkit-1) = 9045eb2a1e2e403b0144d14a5cfe903dc97cfef979c956815a56777c0eb1bf1a
+SHA256 (CVE-2021-4034.patch) = 5930a48bf4262a7c89f8737a1a5a648bd41cfdb6476dcca1140cba6555b67d2c
 SHA256 (99.patch) = 9a84b59d38b3f86c70c5fc3a28cbfe8d7a22cf190eb20ff433f7f53f5ff73a9a
diff --git a/polkit/CVE-2021-4034.patch b/polkit/CVE-2021-4034.patch
new file mode 100644
index 000000000..a06300a53
--- /dev/null
+++ b/polkit/CVE-2021-4034.patch
@@ -0,0 +1,79 @@
+From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Tue, 25 Jan 2022 17:21:46 +0000
+Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
+
+---
+ src/programs/pkcheck.c |  5 +++++
+ src/programs/pkexec.c  | 23 ++++++++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..768525c 100644
+--- a/src/programs/pkcheck.c
++++ b/src/programs/pkcheck.c
+@@ -363,6 +363,11 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+ 
++  if (argc < 1)
++    {
++      exit(126);
++    }
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+ 
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..84e5ef6 100644
+--- a/src/programs/pkexec.c
++++ b/src/programs/pkexec.c
+@@ -488,6 +488,15 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+ 
++
++  /*
++   * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
++   */
++  if (argc<1)
++    {
++      exit(127);
++    }
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -614,10 +623,10 @@ main (int argc, char *argv[])
+ 
+       path = g_strdup (pwstruct.pw_shell);
+       if (!path)
+-	{
++        {
+           g_printerr ("No shell configured or error retrieving pw_shell\n");
+           goto out;
+-	}
++        }
+       /* If you change this, be sure to change the if (!command_line)
+ 	 case below too */
+       command_line = g_strdup (path);
+@@ -636,7 +645,15 @@ main (int argc, char *argv[])
+           goto out;
+         }
+       g_free (path);
+-      argv[n] = path = s;
++      path = s;
++
++      /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
++       * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
++       */
++      if (argv[n] != NULL)
++      {
++        argv[n] = path;
++      }
+     }
+   if (access (path, F_OK) != 0)
+     {
+-- 
+GitLab
+
diff --git a/polkit/Pkgfile b/polkit/Pkgfile
index b8bdf9dad..9e66d09be 100644
--- a/polkit/Pkgfile
+++ b/polkit/Pkgfile
@@ -5,12 +5,14 @@
 
 name=polkit
 version=0.120
-release=2
+release=3
 source=(https://freedesktop.org/software/polkit/releases/$name-$version.tar.gz
-  polkit-1 99.patch)
+  polkit-1
+  CVE-2021-4034.patch 99.patch)
 
 build() {
   patch -Np1 -d $name-$version -i $SRC/99.patch
+  patch -Np1 -d $name-$version -i $SRC/CVE-2021-4034.patch
 
   meson setup $name-$version build \
     --prefix=/usr \