CVE-2015-5232 (C, published 2017-06-07T20:29Z)
Description: value: Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/01org/opa-fm
Files changed:
Esm/ib/include/hsm_config_srvr_data.h
Esm/ib/src/linux/fm_cmd/fm_cmd.c
Esm/ib/src/linux/fm_cmd/hsm_com_client.c
Esm/ib/src/linux/fm_cmd/hsm_com_client_api.c
Esm/ib/src/linux/fm_cmd/hsm_config_client.c
Esm/ib/src/linux/fm_cmd/hsm_config_client_data.h
Esm/ib/src/linux/rem_conf/hsm_config_data.h
Esm/ib/src/linux/startup/opafm.sh
Esm/ib/src/linux/startup/opafmctrl.sh
Commit message: Fix scripts and code that use well-known tmp files.


Vulnerable code:
#define HSM_FM_SCK_PREFIX	"/tmp/"
#define HSM_FM_SCK_BM		"bm_"
	p_fm_config_conx_hdlt	hdl;
		goto die_clean;
		goto die_clean;
			return commandList[i].cmdPtr(hdl, commandList[i].mgr, (argc - optind), &argv[optind]);
die_clean:
	if (hdl) free(hdl);
		close(fd);
		return HSM_COM_PATH_ERR;
		unlink(hdl->c_path);
		close(fd);

		return HSM_COM_BIND_ERR;
		unlink(hdl->c_path);
		close(fd);
		return HSM_COM_CHMOD_ERR;
		unlink(hdl->c_path);
		close(fd);
		return HSM_COM_CONX_ERR;
		return HSM_COM_SEND_ERR;

	return HSM_COM_OK;
	pid_t                   pid;
	pid = getpid();

	sprintf(c_path,"%s%s%d_C_%lu",HSM_FM_SCK_PREFIX,mgr_prefix,
			hdl->instance, (long unsigned)pid);

	return res;


	cleanup:

	if ( hdl ) {
		free(hdl);
		hdl = NULL;
	}

#define HSM_FM_SCK_PREFIX	"/tmp/"
#define HSM_FM_SCK_PREFIX	"/tmp/"
#define HSM_FM_SCK_BM		"bm_"
temp=/tmp/ifsfm$$
temp=/tmp/ifsfm$$

Fixed code:
#define HSM_FM_SCK_PREFIX	"/opt/opafm/"
#include <unistd.h>
#include "hsm_com_client_data.h"
	p_fm_config_conx_hdlt	hdl = NULL;
		goto cleanup;
		goto cleanup;
			res = commandList[i].cmdPtr(hdl, commandList[i].mgr, (argc - optind), &argv[optind]);
			goto cleanup;
cleanup:
	if (hdl)
	{
		if (hdl->sm_hdl)
		{
			if (hdl->sm_hdl->c_path[0])
				unlink(hdl->sm_hdl->c_path);
		}
		if (hdl->pm_hdl)
		{
			if (hdl->pm_hdl->c_path[0])
				unlink(hdl->pm_hdl->c_path);
		}
		if (hdl->fe_hdl)
		{
			if (hdl->fe_hdl->c_path[0])
				unlink(hdl->fe_hdl->c_path);
		}
		free(hdl);
	}

	hsm_com_errno_t		res = HSM_COM_OK;
		res = HSM_COM_PATH_ERR;
		goto cleanup;
		res = HSM_COM_BIND_ERR;
		goto cleanup;
		res = HSM_COM_CHMOD_ERR;
		goto cleanup;
		res = HSM_COM_CONX_ERR;
		goto cleanup;
		res = HSM_COM_SEND_ERR;
	return res;
cleanup:
	close(fd);
	return res;
	if (mkstemp(hdl->c_path) == -1)
	{
		res = HSM_COM_PATH_ERR;
		goto cleanup;
	}
	sprintf(c_path,"%s%s%d_C_XXXXXX",HSM_FM_SCK_PREFIX,mgr_prefix,hdl->instance);
cleanup:
#define HSM_FM_SCK_PREFIX	"/opt/opafm/"
#define HSM_FM_SCK_PREFIX	"/opt/opafm/"
temp=$(mktemp "/tmp/ifsfmXXXXX")
temp=$(mktemp "/tmp/ifsfmXXXXX")