1From 85c2dd9275cdfb369f613089f22733c0f1ba2aec Mon Sep 17 00:00:00 2001
2From: Jan Rybar <jrybar@redhat.com>
3Date: Tue, 25 Jan 2022 17:21:46 +0000
4Subject: [PATCH 1/3] pkexec: local privilege escalation (CVE-2021-4034)
5
6Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
7
8---
9 src/programs/pkcheck.c |  5 +++++
10 src/programs/pkexec.c  | 23 ++++++++++++++++++++---
11 2 files changed, 25 insertions(+), 3 deletions(-)
12
13CVE: CVE-2021-4034
14Upstream-Status: Backport [a2bf5c9c83b6ae46cbd5c779d3055bff81ded683]
15
16diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
17index f1bb4e1..768525c 100644
18--- a/src/programs/pkcheck.c
19+++ b/src/programs/pkcheck.c
20@@ -363,6 +363,11 @@ main (int argc, char *argv[])
21   local_agent_handle = NULL;
22   ret = 126;
23
24+  if (argc < 1)
25+    {
26+      exit(126);
27+    }
28+
29   /* Disable remote file access from GIO. */
30   setenv ("GIO_USE_VFS", "local", 1);
31
32diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
33index 7698c5c..84e5ef6 100644
34--- a/src/programs/pkexec.c
35+++ b/src/programs/pkexec.c
36@@ -488,6 +488,15 @@ main (int argc, char *argv[])
37   pid_t pid_of_caller;
38   gpointer local_agent_handle;
39
40+
41+  /*
42+   * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
43+   */
44+  if (argc<1)
45+    {
46+      exit(127);
47+    }
48+
49   ret = 127;
50   authority = NULL;
51   subject = NULL;
52@@ -614,10 +623,10 @@ main (int argc, char *argv[])
53
54       path = g_strdup (pwstruct.pw_shell);
55       if (!path)
56-	{
57+        {
58           g_printerr ("No shell configured or error retrieving pw_shell\n");
59           goto out;
60-	}
61+        }
62       /* If you change this, be sure to change the if (!command_line)
63 	 case below too */
64       command_line = g_strdup (path);
65@@ -636,7 +645,15 @@ main (int argc, char *argv[])
66           goto out;
67         }
68       g_free (path);
69-      argv[n] = path = s;
70+      path = s;
71+
72+      /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
73+       * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
74+       */
75+      if (argv[n] != NULL)
76+      {
77+        argv[n] = path;
78+      }
79     }
80   if (access (path, F_OK) != 0)
81     {
82--
832.20.1
84
85