gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/modules/security/wrappers: limit argv0 to 512 bytes

Browse Source 
This mitigates CVE-2023-6246, crucially without a mass-rebuild.

Change-Id: I762a0d489ade88dafd3775d54a09f555dc8c2527
This commit is contained in:
edef
2024-02-01 17:31:37 +00:00
parent 97b17f3236
commit b4c9840652
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/modules/security/wrappers/wrapper.c
View File

@@ -172,6 +172,13 @@ static int make_caps_ambient(const char *self_path) {
int main(int argc, char **argv) { int main(int argc, char **argv) {
ASSERT(argc >= 1); ASSERT(argc >= 1);
// argv[0] goes into a lot of places, to a far greater degree than other elements
// of argv. glibc has had buffer overflows relating to argv[0], eg CVE-2023-6246.
// Since we expect the wrappers to be invoked from either $PATH or /run/wrappers/bin,
// there should be no reason to pass any particularly large values here, so we can
// be strict for strictness' sake.
ASSERT(strlen(argv[0]) < 512);
int debug = getenv(wrapper_debug) != NULL; int debug = getenv(wrapper_debug) != NULL;
// Drop insecure environment variables explicitly // Drop insecure environment variables explicitly