rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.
Vulnerability ID: CVE-2017-18203
CWE: CWE-362
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-02-27
File: drivers/md/dm.c
Commit message: dm: fix race between dm_get_from_kobject() and __dm_destroy()

The following BUG_ON was hit when testing repeat creation and removal of
DM devices:

    kernel BUG at drivers/md/dm.c:2919!
    CPU: 7 PID: 750 Comm: systemd-udevd Not tainted 4.1.44
    Call Trace:
     [<ffffffff81649e8b>] dm_get_from_kobject+0x34/0x3a
     [<ffffffff81650ef1>] dm_attr_show+0x2b/0x5e
     [<ffffffff817b46d1>] ? mutex_lock+0x26/0x44
     [<ffffffff811df7f5>] sysfs_kf_seq_show+0x83/0xcf
     [<ffffffff811de257>] kernfs_seq_show+0x23/0x25
     [<ffffffff81199118>] seq_read+0x16f/0x325
     [<ffffffff811de994>] kernfs_fop_read+0x3a/0x13f
     [<ffffffff8117b625>] __vfs_read+0x26/0x9d
     [<ffffffff8130eb59>] ? security_file_permission+0x3c/0x44
     [<ffffffff8117bdb8>] ? rw_verify_area+0x83/0xd9
     [<ffffffff8117be9d>] vfs_read+0x8f/0xcf
     [<ffffffff81193e34>] ? __fdget_pos+0x12/0x41
     [<ffffffff8117c686>] SyS_read+0x4b/0x76
     [<ffffffff817b606e>] system_call_fastpath+0x12/0x71

The bug can be easily triggered, if an extra delay (e.g. 10ms) is added
between the test of DMF_FREEING & DMF_DELETING and dm_get() in
dm_get_from_kobject().

To fix it, we need to ensure the test of DMF_FREEING & DMF_DELETING and
dm_get() are done in an atomic way, so _minor_lock is used.

The other callers of dm_get() have also been checked to be OK: some
callers invoke dm_get() under _minor_lock, some callers invoke it under
_hash_lock, and dm_start_request() invoke it after increasing
md->open_count.

Cc: stable@vger.kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Commit author: Hou Tao

Vulnerable version (before fix):
 struct mapped_device *dm_get_from_kobject(struct kobject *kobj)  	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);  	if (test_bit(DMF_FREEING, &md->flags) || 	    dm_deleting_md(md)) 		return NULL;  	dm_get(md); 	return md; } 

Fixed version (after fix):
 struct mapped_device *dm_get_from_kobject(struct kobject *kobj)  	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);  	spin_lock(&_minor_lock); 	if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) { 		md = NULL; 		goto out; 	} 	dm_get(md); out: 	spin_unlock(&_minor_lock);  	return md; } 

Patch:
patch: @@ -2711,11 +2711,15 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
 
 	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
 
-	if (test_bit(DMF_FREEING, &md->flags) ||
-	    dm_deleting_md(md))
-		return NULL;
-
+	spin_lock(&_minor_lock);
+	if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) {
+		md = NULL;
+		goto out;
+	}
 	dm_get(md);
+out:
+	spin_unlock(&_minor_lock);
+
 	return md;
 }
path: drivers/md/dm.c
Vulnerability: fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.
Vulnerability ID: CVE-2017-18241
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-03-21
File: fs/f2fs/segment.c
Commit message: f2fs: fix a panic caused by NULL flush_cmd_control

Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:

        if (!test_opt(sbi, FLUSH_MERGE)) {
                ret = submit_flush_wait(sbi);
                atomic_inc(&fcc->issued_flush);   ->  Here, fcc illegal
                return ret;
        }

Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Commit author: Yunlei He

Vulnerable version (before fix):
 int create_flush_cmd_control(struct f2fs_sb_info *sbi) 	init_waitqueue_head(&fcc->flush_wait_queue); 	init_llist_head(&fcc->issue_list); 	SM_I(sbi)->fcc_info = fcc; init_thread: 	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi, 				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev)); int build_segment_manager(struct f2fs_sb_info *sbi)  	INIT_LIST_HEAD(&sm_info->sit_entry_set);  	if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) { 		err = create_flush_cmd_control(sbi); 		if (err) 			return err;

Fixed version (after fix):
 int create_flush_cmd_control(struct f2fs_sb_info *sbi) 	init_waitqueue_head(&fcc->flush_wait_queue); 	init_llist_head(&fcc->issue_list); 	SM_I(sbi)->fcc_info = fcc; 	if (!test_opt(sbi, FLUSH_MERGE)) 		return err;  init_thread: 	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi, 				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev)); int build_segment_manager(struct f2fs_sb_info *sbi)  	INIT_LIST_HEAD(&sm_info->sit_entry_set);  	if (!f2fs_readonly(sbi->sb)) { 		err = create_flush_cmd_control(sbi); 		if (err) 			return err;

Patch:
patch: @@ -566,6 +566,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
 	init_waitqueue_head(&fcc->flush_wait_queue);
 	init_llist_head(&fcc->issue_list);
 	SM_I(sbi)->fcc_info = fcc;
+	if (!test_opt(sbi, FLUSH_MERGE))
+		return err;
+
 init_thread:
 	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
 				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
@@ -3240,7 +3243,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
 
 	INIT_LIST_HEAD(&sm_info->sit_entry_set);
 
-	if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
+	if (!f2fs_readonly(sbi->sb)) {
 		err = create_flush_cmd_control(sbi);
 		if (err)
 			return err;
path: fs/f2fs/segment.c
Vulnerability: The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.
Vulnerability ID: CVE-2017-18255
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-03-31
File: kernel/events/core.c
Commit message: perf/core: Fix the perf_cpu_time_max_percent check

Use "proc_dointvec_minmax" instead of "proc_dointvec" to check the input
value from user-space.

If not, we can set a big value and some vars will overflow like
"sysctl_perf_event_sample_rate" which will cause a lot of unexpected
problems.

Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <acme@kernel.org>
Cc: <alexander.shishkin@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Link: http://lkml.kernel.org/r/1487829879-56237-1-git-send-email-tanxiaojun@huawei.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Commit author: Tan Xiaojun

Vulnerable version (before fix):
 int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, 				void __user *buffer, size_t *lenp, 				loff_t *ppos) { 	int ret = proc_dointvec(table, write, buffer, lenp, ppos);  	if (ret || !write) 		return ret;

Fixed version (after fix):
 int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, 				void __user *buffer, size_t *lenp, 				loff_t *ppos) { 	int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);  	if (ret || !write) 		return ret;

Patch:
patch: @@ -455,7 +455,7 @@ int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write,
 				void __user *buffer, size_t *lenp,
 				loff_t *ppos)
 {
-	int ret = proc_dointvec(table, write, buffer, lenp, ppos);
+	int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 
 	if (ret || !write)
 		return ret;
path: kernel/events/core.c
Vulnerability: The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl.
Vulnerability ID: CVE-2017-18257
CWE: CWE-190
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-04-04
File: fs/f2fs/data.c
Commit message: f2fs: fix a dead loop in f2fs_fiemap()

A dead loop can be triggered in f2fs_fiemap() using the test case
as below:

	...
	fd = open();
	fallocate(fd, 0, 0, 4294967296);
	ioctl(fd, FS_IOC_FIEMAP, fiemap_buf);
	...

It's caused by an overflow in __get_data_block():
	...
	bh->b_size = map.m_len << inode->i_blkbits;
	...
map.m_len is an unsigned int, and bh->b_size is a size_t which is 64 bits
on 64 bits archtecture, type conversion from an unsigned int to a size_t
will result in an overflow.

In the above-mentioned case, bh->b_size will be zero, and f2fs_fiemap()
will call get_data_block() at block 0 again an again.

Fix this by adding a force conversion before left shift.

Signed-off-by: Wei Fang <fangwei1@huawei.com>
Acked-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Commit author: Wei Fang

Vulnerable version (before fix):
 static int __get_data_block(struct inode *inode, sector_t iblock, 	if (!err) { 		map_bh(bh, inode->i_sb, map.m_pblk); 		bh->b_state = (bh->b_state & ~F2FS_MAP_FLAGS) | map.m_flags; 		bh->b_size = map.m_len << inode->i_blkbits; 	} 	return err; }

Fixed version (after fix):
 static int __get_data_block(struct inode *inode, sector_t iblock, 	if (!err) { 		map_bh(bh, inode->i_sb, map.m_pblk); 		bh->b_state = (bh->b_state & ~F2FS_MAP_FLAGS) | map.m_flags; 		bh->b_size = (u64)map.m_len << inode->i_blkbits; 	} 	return err; }

Patch:
patch: @@ -964,7 +964,7 @@ static int __get_data_block(struct inode *inode, sector_t iblock,
 	if (!err) {
 		map_bh(bh, inode->i_sb, map.m_pblk);
 		bh->b_state = (bh->b_state & ~F2FS_MAP_FLAGS) | map.m_flags;
-		bh->b_size = map.m_len << inode->i_blkbits;
+		bh->b_size = (u64)map.m_len << inode->i_blkbits;
 	}
 	return err;
 }
path: fs/f2fs/data.c
Vulnerability: ** DISPUTED ** The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar.
Vulnerability ID: CVE-2017-18343
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/symfony/debug
Published: 2018-07-20
File: ExceptionHandler.php
Commit message: fix XSS vulnerability

details: https://github.com/symfony/symfony/issues/27987
Commit author: omer citak

Vulnerable version (before fix):
 private function formatArgs(array $args)                 $formattedValue = str_replace("\n", '', var_export($this->escapeHtml((string) $item[1]), true));             }              $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);         }          return implode(', ', $result);

Fixed version (after fix):
 private function formatArgs(array $args)                 $formattedValue = str_replace("\n", '', var_export($this->escapeHtml((string) $item[1]), true));             }              $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);         }          return implode(', ', $result);

Patch:
patch: @@ -398,7 +398,7 @@ private function formatArgs(array $args)
                 $formattedValue = str_replace("\n", '', var_export($this->escapeHtml((string) $item[1]), true));
             }
 
-            $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);
+            $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);
         }
 
         return implode(', ', $result);
path: ExceptionHandler.php
Vulnerability: In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.
Vulnerability ID: CVE-2017-18360
CWE: CWE-369
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-01-31
File: drivers/usb/serial/io_ti.c
Commit message: USB: serial: io_ti: fix div-by-zero in set_termios

Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.

Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>     # 2.6.12
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Commit author: Johan Hovold

Vulnerable version (before fix):
 static void change_port_settings(struct tty_struct *tty, 	if (!baud) { 		/* pick a default, any default... */ 		baud = 9600; 	} else 		tty_encode_baud_rate(tty, baud, baud);  	edge_port->baud_rate = baud; 	config->wBaudRate = (__u16)((461550L + baud/2) / baud);

Fixed version (after fix):
 static void change_port_settings(struct tty_struct *tty, 	if (!baud) { 		/* pick a default, any default... */ 		baud = 9600; 	} else { 		/* Avoid a zero divisor. */ 		baud = min(baud, 461550); 		tty_encode_baud_rate(tty, baud, baud); 	}  	edge_port->baud_rate = baud; 	config->wBaudRate = (__u16)((461550L + baud/2) / baud);

Patch:
patch: @@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
 	if (!baud) {
 		/* pick a default, any default... */
 		baud = 9600;
-	} else
+	} else {
+		/* Avoid a zero divisor. */
+		baud = min(baud, 461550);
 		tty_encode_baud_rate(tty, baud, baud);
+	}
 
 	edge_port->baud_rate = baud;
 	config->wBaudRate = (__u16)((461550L + baud/2) / baud);
path: drivers/usb/serial/io_ti.c
Vulnerability: In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.
Vulnerability ID: CVE-2017-18379
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-27
File: drivers/nvme/target/fc.c
Commit message: nvmet-fc: ensure target queue id within range.

When searching for queue id's ensure they are within the expected range.

Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: James Smart

Vulnerable version (before fix):
 nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport, 	u16 qid = nvmet_fc_getqueueid(connection_id); 	unsigned long flags;  	spin_lock_irqsave(&tgtport->lock, flags); 	list_for_each_entry(assoc, &tgtport->assoc_list, a_list) { 		if (association_id == assoc->association_id) {

Fixed version (after fix):
 nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport, 	u16 qid = nvmet_fc_getqueueid(connection_id); 	unsigned long flags;  	if (qid > NVMET_NR_QUEUES) 		return NULL;  	spin_lock_irqsave(&tgtport->lock, flags); 	list_for_each_entry(assoc, &tgtport->assoc_list, a_list) { 		if (association_id == assoc->association_id) {

Patch:
patch: @@ -783,6 +783,9 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
 	u16 qid = nvmet_fc_getqueueid(connection_id);
 	unsigned long flags;
 
+	if (qid > NVMET_NR_QUEUES)
+		return NULL;
+
 	spin_lock_irqsave(&tgtport->lock, flags);
 	list_for_each_entry(assoc, &tgtport->assoc_list, a_list) {
 		if (association_id == assoc->association_id) {
path: drivers/nvme/target/fc.c
Vulnerability: nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
Vulnerability ID: CVE-2017-18594
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/nmap/nmap
Published: 2019-08-29
File: nse_libssh2.cc
Commit message: Avoid a crash (double-free) when SSH connection fails
Commit author: dmiller

Vulnerable version (before fix):
 extern "C" { } #include "nse_lua.h"  #include "nse_debug.h" #include "nse_nsock.h" #include "nse_utility.h"  static int do_session_handshake (lua_State *L, int status, lua_KContext ctx) {      if (rc) {         libssh2_session_free(sshu->session);         return luaL_error(L, "Unable to complete libssh2 handshake.");     }  static int userauth_list (lua_State *L, int status, lua_KContext ctx) { }  /* * Returns list of supported authenication methods */ static int l_userauth_list (lua_State *L) {     return userauth_list(L, 0, 0);

Fixed version (after fix):
 extern "C" { } #include "nse_lua.h"  #include "nse_nsock.h" #include "nse_utility.h"  static int do_session_handshake (lua_State *L, int status, lua_KContext ctx) {      if (rc) {         libssh2_session_free(sshu->session);         sshu->session = NULL;         return luaL_error(L, "Unable to complete libssh2 handshake.");     }  static int userauth_list (lua_State *L, int status, lua_KContext ctx) { }  /* * Returns list of supported authentication methods */ static int l_userauth_list (lua_State *L) {     return userauth_list(L, 0, 0);

Patch:
patch: @@ -12,7 +12,6 @@ extern "C" {
 }
 #include "nse_lua.h"
 
-#include "nse_debug.h"
 #include "nse_nsock.h"
 #include "nse_utility.h"
 
@@ -295,6 +294,7 @@ static int do_session_handshake (lua_State *L, int status, lua_KContext ctx) {
 
     if (rc) {
         libssh2_session_free(sshu->session);
+        sshu->session = NULL;
         return luaL_error(L, "Unable to complete libssh2 handshake.");
     }
 
@@ -478,7 +478,7 @@ static int userauth_list (lua_State *L, int status, lua_KContext ctx) {
 }
 
 /*
-* Returns list of supported authenication methods
+* Returns list of supported authentication methods
 */
 static int l_userauth_list (lua_State *L) {
     return userauth_list(L, 0, 0);
path: nse_libssh2.cc
Vulnerability: It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Vulnerability ID: CVE-2017-2582
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/keycloak/keycloak
Published: 2018-07-26
File: saml-core/src/main/java/org/keycloak/saml/common/util/StaxParserUtil.java
Commit message: KEYCLOAK-4160
Commit author: Hynek Mlnarik

Vulnerable version (before fix):
 public static boolean wasWhitespacePeeked(XMLEventReader xmlEventReader, XMLEven      */     public static String getAttributeValue(Attribute attribute) {         String str = trim(attribute.getValue());         str = StringUtil.getSystemPropertyAsString(str);         return str;     }  public static String getElementText(XMLEventReader xmlEventReader) throws Parsin         String str = null;         try {             str = xmlEventReader.getElementText().trim();             str = StringUtil.getSystemPropertyAsString(str);         } catch (XMLStreamException e) {             throw logger.parserException(e);         }

Fixed version (after fix):
 public static boolean wasWhitespacePeeked(XMLEventReader xmlEventReader, XMLEven      */     public static String getAttributeValue(Attribute attribute) {         String str = trim(attribute.getValue());         return str;     }  public static String getElementText(XMLEventReader xmlEventReader) throws Parsin         String str = null;         try {             str = xmlEventReader.getElementText().trim();         } catch (XMLStreamException e) {             throw logger.parserException(e);         }

Patch:
patch: @@ -122,7 +122,6 @@ public static boolean wasWhitespacePeeked(XMLEventReader xmlEventReader, XMLEven
      */
     public static String getAttributeValue(Attribute attribute) {
         String str = trim(attribute.getValue());
-        str = StringUtil.getSystemPropertyAsString(str);
         return str;
     }
 
@@ -224,7 +223,6 @@ public static String getElementText(XMLEventReader xmlEventReader) throws Parsin
         String str = null;
         try {
             str = xmlEventReader.getElementText().trim();
-            str = StringUtil.getSystemPropertyAsString(str);
         } catch (XMLStreamException e) {
             throw logger.parserException(e);
         }
path: saml-core/src/main/java/org/keycloak/saml/common/util/StaxParserUtil.java
Vulnerability: A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Vulnerability ID: CVE-2017-2616
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/karelzak/util-linux
Published: 2018-07-27
File: login-utils/su-common.c
Commit message: su: properly clear child PID

Reported-by: Tobias Stöckmann <tobias@stoeckmann.org>
Signed-off-by: Karel Zak <kzak@redhat.com>
Commit author: Karel Zak

Vulnerable version (before fix):
 create_watching_parent (void)             }           else             status = WEXITSTATUS (status);         }       else if (caught_signal)         status = caught_signal + 128; create_watching_parent (void)   else     status = 1;    if (caught_signal)     {       fprintf (stderr, _("\nSession terminated, killing shell..."));       kill (child, SIGTERM); create_watching_parent (void)    if (caught_signal)     {       sleep (2);       kill (child, SIGKILL);       fprintf (stderr, _(" ...killed.\n"));        /* Let's terminate itself with the received signal.        *

Fixed version (after fix):
 create_watching_parent (void)             }           else             status = WEXITSTATUS (status);  	  /* child is gone, don't use the PID anymore */ 	  child = (pid_t) -1;         }       else if (caught_signal)         status = caught_signal + 128; create_watching_parent (void)   else     status = 1;    if (caught_signal && child != (pid_t)-1)     {       fprintf (stderr, _("\nSession terminated, killing shell..."));       kill (child, SIGTERM); create_watching_parent (void)    if (caught_signal)     {       if (child != (pid_t)-1) 	{ 	  sleep (2); 	  kill (child, SIGKILL); 	  fprintf (stderr, _(" ...killed.\n")); 	}        /* Let's terminate itself with the received signal.        *

Patch:
patch: @@ -368,6 +368,9 @@ create_watching_parent (void)
             }
           else
             status = WEXITSTATUS (status);
+
+	  /* child is gone, don't use the PID anymore */
+	  child = (pid_t) -1;
         }
       else if (caught_signal)
         status = caught_signal + 128;
@@ -377,7 +380,7 @@ create_watching_parent (void)
   else
     status = 1;
 
-  if (caught_signal)
+  if (caught_signal && child != (pid_t)-1)
     {
       fprintf (stderr, _("\nSession terminated, killing shell..."));
       kill (child, SIGTERM);
@@ -387,9 +390,12 @@ create_watching_parent (void)
 
   if (caught_signal)
     {
-      sleep (2);
-      kill (child, SIGKILL);
-      fprintf (stderr, _(" ...killed.\n"));
+      if (child != (pid_t)-1)
+	{
+	  sleep (2);
+	  kill (child, SIGKILL);
+	  fprintf (stderr, _(" ...killed.\n"));
+	}
 
       /* Let's terminate itself with the received signal.
        *
path: login-utils/su-common.c