]> git.proxmox.com Git - mirror_qemu.git/commit
projects / mirror_qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a33eda0) | patch
9pfs: local: statfs: don't follow symlinks
authorGreg Kurz <groug@kaod.org>
Sun, 26 Feb 2017 22:43:25 +0000 (23:43 +0100)
committerGreg Kurz <groug@kaod.org>
Tue, 28 Feb 2017 10:21:15 +0000 (11:21 +0100)
commit31e51d1c15b35dc98b88a301812914b70a2b55dc
treef1bdaeddcf8ca308a79fb74d409e454b5ea5e3b8tree
parenta33eda0dd99e00faa3bacae43d19490bb9500e07commit | diff
9pfs: local: statfs: don't follow symlinks

The local_statfs() callback is vulnerable to symlink attacks because it
calls statfs() which follows symbolic links in all path elements.

This patch converts local_statfs() to rely on open_nofollow() and fstatfs()
instead.

This partly fixes CVE-2016-9602.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
hw/9pfs/9p-local.c diff | blob | blame | history
QEMU mirror