File CVE-2017-0358.patch of Package ntfs-3g_ntfsprogs.10818

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2017-0358.patch of Package ntfs-3g_ntfsprogs.10818

Clear the environment variables when running modprobe by using execle with
NULL environment instead of execl.

Fixes https://bugzilla.opensuse.org/show_bug.cgi?id=1022500

bsc#1022500, CVE-2017-0358.patch

--- ntfs-3g/src/lowntfs-3g.c.ref        2016-12-31 08:56:59.011749600 +0100
+++ ntfs-3g/src/lowntfs-3g.c    2017-01-05 14:41:52.041473700 +0100
@@ -3996,13 +3996,14 @@
 	struct stat st;
 	pid_t pid;
 	const char *cmd = "/sbin/modprobe";
+	char *env = (char*)NULL;
 	struct timespec req = { 0, 100000000 };   /* 100 msec */
 	fuse_fstype fstype;
         
 	if (!stat(cmd, &st) && !geteuid()) {
 		pid = fork();
 		if (!pid) {
-			execl(cmd, cmd, "fuse", NULL);
+			execle(cmd, cmd, "fuse", NULL, &env);
 			_exit(1);
 		} else if (pid != -1)
 			waitpid(pid, NULL, 0);
--- ntfs-3g/src/ntfs-3g.c.ref   2016-12-31 08:56:59.022518700 +0100
+++ ntfs-3g/src/ntfs-3g.c       2017-01-05 15:45:45.912499400 +0100
@@ -3606,13 +3606,14 @@
 	struct stat st;
 	pid_t pid;
 	const char *cmd = "/sbin/modprobe";
+	char *env = (char*)NULL;
 	struct timespec req = { 0, 100000000 };   /* 100 msec */
 	fuse_fstype fstype;
 	
 	if (!stat(cmd, &st) && !geteuid()) {
 		pid = fork();
 		if (!pid) {
-			execl(cmd, cmd, "fuse", NULL);
+			execle(cmd, cmd, "fuse", NULL, &env);
 			_exit(1);
 		} else if (pid != -1)
 			waitpid(pid, NULL, 0);

Places

File CVE-2017-0358.patch of Package ntfs-3g_ntfsprogs.10818

Places