aboutsummaryrefslogtreecommitdiff
path: root/qemu-tech.texi
diff options
context:
space:
mode:
authorGreg Kurz <groug@kaod.org>2017-02-26 23:42:51 +0100
committerGreg Kurz <groug@kaod.org>2017-02-28 11:21:15 +0100
commit72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3 (patch)
treef331ff1b1b177f6273edb2f989c3f95159c41e39 /qemu-tech.texi
parent3e36aba757f76673007a80b3cd56a4062c2e3462 (diff)
9pfs: local: lremovexattr: don't follow symlinks
The local_lremovexattr() callback is vulnerable to symlink attacks because it calls lremovexattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fremovexattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lremovexattr(). local_lremovexattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'qemu-tech.texi')
0 files changed, 0 insertions, 0 deletions