From 8b3c58251146d2e982a6c9fdb3828ca65e307a96 Mon Sep 17 00:00:00 2001 From: Gary Lockyer Date: Mon, 11 Dec 2017 09:31:33 +1300 Subject: [PATCH] lib/async_req/async_sock.c set socket close on exec Set SOCKET_CLOEXEC on the sockets returned by accept. This ensures that the socket is unavailable to any child process created by system(). Making it harder for malicious code to set up a command channel, as seen in the exploit for CVE-2015-0240 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett --- lib/async_req/async_sock.c | 1 + lib/tevent/echo_server.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/async_req/async_sock.c b/lib/async_req/async_sock.c index db3916e07e7..0a8a333f4f3 100644 --- a/lib/async_req/async_sock.c +++ b/lib/async_req/async_sock.c @@ -738,6 +738,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde, tevent_req_error(req, errno); return; } + smb_set_close_on_exec(ret); state->sock = ret; tevent_req_done(req); } diff --git a/lib/tevent/echo_server.c b/lib/tevent/echo_server.c index 3b2122dac11..f93d8bcdee7 100644 --- a/lib/tevent/echo_server.c +++ b/lib/tevent/echo_server.c @@ -118,7 +118,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde, tevent_req_error(req, errno); return; } - smb_set_close_on_exec(state->listen_sock); + smb_set_close_on_exec(ret); state->sock = ret; tevent_req_done(req); } -- 2.47.3