1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
From: Robert Luberda <robert@debian.org>
Date: Wed, 23 Apr 2014 00:28:19 +0200
Subject: 14 Fix unchecked setuid call
Fix the following issue noticed by John Lightsey:
super.c does an unchecked setuid(getuid()) when the -F flag
is supplied pointing to a configuration file to test. This opens
super up to the RLIM_NPROC style exploits on 2.6 kernels.
The issue was assigned number CVE-2014-0470.
---
super.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/super.c b/super.c
index abea061..1c21886 100644
--- a/super.c
+++ b/super.c
@@ -849,7 +849,9 @@ by `-o %s' is overridden by file `%s'", *o_file, superfile);
* to the real uid.
*/
if (getuid() != 0) {
- setuid(getuid());
+ if (setuid(getuid()) == -1)
+ Error(1, 1, "Can't set uid to %d: ", getuid());
+
fprintf(stderr,
"\t** Since you have supplied a super.tab file that isn't the default,\n");
fprintf(stderr,
|
