rpms/udev/F-9 udev-CVE-2009-1185.patch, NONE, 1.1 udev-118-sysconf.patch, 1.2, 1.3 udev.spec, 1.249, 1.250

[Harald Hoyer]

Author: harald

Update of /cvs/pkgs/rpms/udev/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11253

Modified Files:
	udev-118-sysconf.patch udev.spec 
Added Files:
	udev-CVE-2009-1185.patch 
Log Message:
* Tue Apr 14 2009 Harald Hoyer <harald at redhat.com> 124-3
- fix for CVE-2009-1185


udev-CVE-2009-1185.patch:

--- NEW FILE udev-CVE-2009-1185.patch ---
diff -ruNp udev-124~/udevd.c udev-124/udevd.c
--- udev-124~/udevd.c	2008-06-11 22:24:30.000000000 -0700
+++ udev-124/udevd.c	2009-04-08 16:30:06.000000000 -0700
@@ -753,16 +753,34 @@ static struct udevd_uevent_msg *get_netl
 	struct udevd_uevent_msg *msg;
 	int bufpos;
 	ssize_t size;
+	struct sockaddr_nl snl;
+	struct msghdr smsg;
+	struct iovec iov;
 	static char buffer[UEVENT_BUFFER_SIZE+512];
 	char *pos;
 
-	size = recv(uevent_netlink_sock, &buffer, sizeof(buffer), 0);
+	iov.iov_base = buffer;
+	iov.iov_len = sizeof(buffer);
+
+	memset(&smsg, 0x00, sizeof(struct msghdr));
+	smsg.msg_name = &snl;
+	smsg.msg_namelen = sizeof(struct sockaddr_nl);
+	smsg.msg_iov = &iov;
+	smsg.msg_iovlen = 1;
+
+	size = recvmsg(uevent_netlink_sock, &smsg, 0);
 	if (size <  0) {
 		if (errno != EINTR)
 			err("unable to receive kernel netlink message: %s\n", strerror(errno));
 		return NULL;
 	}
 
+	if ((snl.nl_groups != 1) || (snl.nl_pid != 0)) {
+		info("ignored netlink message from invalid group/sender %d/%d\n",
+		     snl.nl_groups, snl.nl_pid);
+		return NULL;
+	}
+
 	if ((size_t)size > sizeof(buffer)-1)
 		size = sizeof(buffer)-1;
 	buffer[size] = '\0';

udev-118-sysconf.patch:

Index: udev-118-sysconf.patch
===================================================================
RCS file: /cvs/pkgs/rpms/udev/F-9/udev-118-sysconf.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- udev-118-sysconf.patch	4 Apr 2008 13:35:38 -0000	1.2
+++ udev-118-sysconf.patch	15 Apr 2009 17:07:54 -0000	1.3
@@ -1,18 +1,18 @@
-diff -up udev-120/etc/udev/rules.d/60-persistent-storage.rules.sysconf udev-120/etc/udev/rules.d/60-persistent-storage.rules
---- udev-120/etc/udev/rules.d/60-persistent-storage.rules.sysconf	2008-04-03 21:12:53.000000000 +0200
-+++ udev-120/etc/udev/rules.d/60-persistent-storage.rules	2008-04-04 14:11:35.000000000 +0200
-@@ -3,6 +3,8 @@
- # persistent storage links: /dev/disk/{by-id,by-uuid,by-label,by-path}
- # scheme based on "Linux persistent device names", 2004, Hannes Reinecke <hare at suse.de>
+diff -up udev-124/etc/udev/rules.d/60-persistent-storage.rules.sysconf udev-124/etc/udev/rules.d/60-persistent-storage.rules
+--- udev-124/etc/udev/rules.d/60-persistent-storage.rules.sysconf	2008-06-12 07:24:30.000000000 +0200
++++ udev-124/etc/udev/rules.d/60-persistent-storage.rules	2009-04-14 15:38:25.000000000 +0200
+@@ -6,6 +6,8 @@
+ # forward scsi device event to corresponding block device
+ ACTION=="change", SUBSYSTEM=="scsi", ENV{DEVTYPE}=="scsi_device", TEST=="block", ATTR{block/*/uevent}="change"
  
 +ENV{UDEV_NO_PERSISTENT_STORAGE}=="1", GOTO="persistent_storage_end"
 +
  ACTION!="add|change", GOTO="persistent_storage_end"
  SUBSYSTEM!="block", GOTO="persistent_storage_end"
  
-diff -up udev-120/etc/udev/rules.d/60-persistent-storage-tape.rules.sysconf udev-120/etc/udev/rules.d/60-persistent-storage-tape.rules
---- udev-120/etc/udev/rules.d/60-persistent-storage-tape.rules.sysconf	2008-04-03 21:12:53.000000000 +0200
-+++ udev-120/etc/udev/rules.d/60-persistent-storage-tape.rules	2008-04-04 14:10:46.000000000 +0200
+diff -up udev-124/etc/udev/rules.d/60-persistent-storage-tape.rules.sysconf udev-124/etc/udev/rules.d/60-persistent-storage-tape.rules
+--- udev-124/etc/udev/rules.d/60-persistent-storage-tape.rules.sysconf	2008-06-12 07:24:30.000000000 +0200
++++ udev-124/etc/udev/rules.d/60-persistent-storage-tape.rules	2009-04-14 15:38:25.000000000 +0200
 @@ -2,6 +2,8 @@
  
  # persistent storage links: /dev/tape/{by-id,by-path}
@@ -21,4 +21,4 @@
 +
  ACTION!="add|change", GOTO="persistent_storage_tape_end"
  
- KERNEL=="nst[0-9]", SUBSYSTEMS=="scsi", IMPORT{program}="scsi_id --export --whitelisted --fallback-to-sysfs -s %p -d $tempnode", SYMLINK+="tape/by-id/$env{ID_BUS}-$env{ID_SERIAL}-nst"
+ # type 8 devices are "Medium Changers"


Index: udev.spec
===================================================================
RCS file: /cvs/pkgs/rpms/udev/F-9/udev.spec,v
retrieving revision 1.249
retrieving revision 1.250
diff -u -r1.249 -r1.250
--- udev.spec	6 Aug 2008 12:18:39 -0000	1.249
+++ udev.spec	15 Apr 2009 17:07:54 -0000	1.250
@@ -6,7 +6,7 @@
 Summary: A userspace implementation of devfs
 Name: udev
 Version: 124
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: GPLv2
 Group: System Environment/Base
 Provides: udev-persistent = %{version}-%{release}
@@ -24,6 +24,7 @@
 Patch103: udev-089-nopie.patch
 Patch104: udev-091-lib64.patch
 Patch105: udev-vol_id-cdrom.patch
+Patch106: udev-CVE-2009-1185.patch
 
 Patch200: udev-120-rhrules.patch
 
@@ -83,6 +84,7 @@
 %patch103 -p1 -b .nopie
 %patch104 -p1 -b .lib64
 %patch105 -p1 -b .tray
+%patch106 -p1 -b .CVE-2009-1185
 
 %patch200 -p1 -b .rhrules
 
@@ -407,6 +409,9 @@
 %{_libdir}/pkgconfig/libvolume_id.pc 
 
 %changelog
+* Tue Apr 14 2009 Harald Hoyer <harald at redhat.com> 124-3
+- fix for CVE-2009-1185
+
 * Wed Aug 06 2008 Harald Hoyer <harald at redhat.com> 124-2
 - added patch for cdrom tray close bug (rhbz#453095)
 - fixed udevadm syntax in start_udev (credits B.J.W. Polman)