fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-01-03 15:10:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix CVE-2011-4029: File permission change vulnerability.

Browse source 
Use fchmod() to change permissions of the lock file instead
of chmod(), thus avoid the race that can be exploited to set
a symbolic link to any file or directory in the system.

Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Matthieu Herrb 2011-10-17 22:27:35 +02:00
parent 6ba44b91e3
commit b67581cf82
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
os/utils.c
View file

@ -297,7 +297,7 @@ LockServer(void)
FatalError("Could not create lock file in %s\n", tmp); FatalError("Could not create lock file in %s\n", tmp);
(void) sprintf(pid_str, "%10ld\n", (long)getpid()); (void) sprintf(pid_str, "%10ld\n", (long)getpid());
(void) write(lfd, pid_str, 11); (void) write(lfd, pid_str, 11);
(void) chmod(tmp, 0444); (void) fchmod(lfd, 0444);
(void) close(lfd); (void) close(lfd);
/* /*