CVE-2021-35939 (Other, published 2022-08-26T16:15Z)
Description: value: It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity: nan (CVSS v3 base score: 6.7)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rpm-software-management/rpm
Files changed:
INSTALL
configure.ac
lib/fsm.c
Commit message: Validate intermediate symlinks during installation, CVE-2021-35939

Whenever directory changes during unpacking, walk the entire tree from
starting from / and validate any symlinks crossed, fail the install
on invalid links.

This is the first of step of many towards securing our file operations
against local tamperers and besides plugging that one CVE, paves the way
for the next step by adding the necessary directory fd tracking.
This also bumps the rpm OS requirements to a whole new level by requiring
the *at() family of calls from POSIX-1.2008.

This necessarily does a whole lot of huffing and puffing we previously
did not do. It should be possible to cache secure (ie root-owned)
directory structures to avoid validating everything a million times
but for now, just keeping things simple.


Vulnerable code:
    utimes getline localtime_r statvfs getaddrinfo ],
static int fsmMkdir(const char *path, mode_t mode)
    int rc = mkdir(path, (mode & 07777));
	rpmlog(RPMLOG_DEBUG, " %8s (%s, 0%04o) %s\n", __func__,
	       path, (unsigned)(mode & 07777),
		    rc = fsmMkdir(dn, mode);
                    rc = fsmMkdir(fp->fpath, mode);

Fixed code:
Rpm requires a POSIX.1-2008 level operating system.

    utimes getline localtime_r statvfs getaddrinfo \
    openat mkdirat fstatat ],
#include <fcntl.h>
#include "lib/rpmfi_internal.h" /* rpmfiSetOnChdir */
static int fsmMkdir(int dirfd, const char *path, mode_t mode)
    int rc = mkdirat(dirfd, path, (mode & 07777));
	rpmlog(RPMLOG_DEBUG, " %8s (%d %s, 0%04o) %s\n", __func__,
	       dirfd, path, (unsigned)(mode & 07777),
static int fsmOpenat(int dirfd, const char *path, int flags)
{
    struct stat lsb, sb;
    int sflags = flags | O_NOFOLLOW;
    int fd = openat(dirfd, path, sflags);

    /*
     * Only ever follow symlinks by root or target owner. Since we can't
     * open the symlink itself, the order matters: we stat the link *after*
     * opening the target, and if the link ownership changed between the calls
     * it could've only been the link owner or root.
     */
    if (fd < 0 && errno == ELOOP && flags != sflags) {
	int ffd = openat(dirfd, path, flags);
	if (ffd >= 0 && fstatat(dirfd, path, &lsb, AT_SYMLINK_NOFOLLOW) == 0) {
	    if (fstat(ffd, &sb) == 0) {
		if (lsb.st_uid == 0 || lsb.st_uid == sb.st_uid) {
		    fd = ffd;
		} else {
		    close(ffd);
		}
	    }
	}
    }
    return fd;
}

static int fsmDoMkDir(rpmPlugins plugins, int dirfd, const char *dn,
			int owned, mode_t mode)
{
    int rc;
    rpmFsmOp op = (FA_CREATE);
    if (!owned)
	op |= FAF_UNOWNED;

    /* Run fsm file pre hook for all plugins */
    rc = rpmpluginsCallFsmFilePre(plugins, NULL, dn, mode, op);

    if (!rc)
	rc = fsmMkdir(dirfd, dn, mode);

    if (!rc) {
	rc = rpmpluginsCallFsmFilePrepare(plugins, NULL, dn, dn, mode, op);
    }

    /* Run fsm file post hook for all plugins */
    rpmpluginsCallFsmFilePost(plugins, NULL, dn, mode, op, rc);

    if (!rc) {
	rpmlog(RPMLOG_DEBUG,
		"%s directory created with perms %04o\n",
		dn, (unsigned)(mode & 07777));
    }

    return rc;
}

static int ensureDir(rpmPlugins plugins, const char *p, int owned, int create)
{
    char *path = xstrdup(p);
    char *dp = path;
    char *sp = NULL, *bn;
    int oflags = O_RDONLY;

    int dirfd = fsmOpenat(-1, "/", oflags);
    int fd = dirfd; /* special case of "/" */

    while ((bn = strtok_r(dp, "/", &sp)) != NULL) {
	struct stat sb;
	fd = fsmOpenat(dirfd, bn, oflags);

	if (fd < 0 && errno == ENOENT && create) {
	    mode_t mode = S_IFDIR | (_dirPerms & 07777);
	    if (fsmDoMkDir(plugins, dirfd, bn, owned, mode) == 0) {
		fd = fsmOpenat(dirfd, bn, oflags|O_NOFOLLOW);
	    }
	}

	if (fd >= 0 && fstat(fd, &sb) == 0 && !S_ISDIR(sb.st_mode)) {
	    close(fd);
	    errno = ENOTDIR;
	    fd = -1;
	}

	close(dirfd);
	if (fd >= 0) {
	    dirfd = fd;
	} else {
	    dirfd = -1;
	    rpmlog(RPMLOG_ERR, _("failed to open dir %s of %s: %s\n"),
				bn, p, strerror(errno));
	    break;
	}

	dp = NULL;
    }

    free(path);
    return dirfd;
}

		    rc = fsmMkdir(-1, dn, mode);
struct diriter_s {
    int dirfd;
};

static int onChdir(rpmfi fi, void *data)
{
    struct diriter_s *di = data;

    if (di->dirfd >= 0) {
	close(di->dirfd);
	di->dirfd = -1;
    }
    return 0;
}

    struct diriter_s di = { -1 };
    rpmfiSetOnChdir(fi, onChdir, &di);

	    if (di.dirfd == -1) {
		di.dirfd = ensureDir(plugins, rpmfiDN(fi), 0,
				    (fp->action == FA_CREATE));
		if (di.dirfd == -1) {
		    rc = RPMERR_OPEN_FAILED;
		    break;
		}
	    }

                    rc = fsmMkdir(di.dirfd, fp->fpath, mode);
    close(di.dirfd);
    di.dirfd = -1;