From ec10eada04069a4f22010b4b30c0b70b7f6fd887 Mon Sep 17 00:00:00 2001 From: Greg Kurz Date: Sun, 26 Feb 2017 23:43:32 +0100 Subject: [PATCH] 9pfs: local: truncate: don't follow symlinks The local_truncate() callback is vulnerable to symlink attacks because it calls truncate() which follows symbolic links in all path elements. This patch converts local_truncate() to rely on open_nofollow() and ftruncate() instead. This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz Reviewed-by: Stefan Hajnoczi (cherry picked from commit ac125d993b461d4dee4d6df4d93ac3f2eb959d1d) Signed-off-by: Greg Kurz Signed-off-by: Michael Roth --- hw/9pfs/9p-local.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 80b3964a59..5e206e1aff 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -895,13 +895,14 @@ err_out: static int local_truncate(FsContext *ctx, V9fsPath *fs_path, off_t size) { - char *buffer; - int ret; - char *path = fs_path->data; + int fd, ret; - buffer = rpath(ctx, path); - ret = truncate(buffer, size); - g_free(buffer); + fd = local_open_nofollow(ctx, fs_path->data, O_WRONLY, 0); + if (fd == -1) { + return -1; + } + ret = ftruncate(fd, size); + close_preserve_errno(fd); return ret; } -- GitLab