tags 591204 + patch tags 591204 + pending thanks Dear maintainer,
I've prepared an NMU for lvm2 (versioned as 2.02.66-2.1) and uploaded it to DELAYED/1. Please feel free to tell me if I should delay it longer. Regards. Giuseppe
diff -Nru lvm2-2.02.66/debian/changelog lvm2-2.02.66/debian/changelog
--- lvm2-2.02.66/debian/changelog 2010-06-18 11:40:08.000000000 +0200
+++ lvm2-2.02.66/debian/changelog 2010-08-19 11:56:57.000000000 +0200
@@ -1,3 +1,11 @@
+lvm2 (2.02.66-2.1) unstable; urgency=high
+
+ * Non-maintainer upload by the Security Team.
+ * CVE-2010-2526: Fix insecure communication between lvm2 and clvmd
+ (Closes: #591204)
+
+ -- Giuseppe Iuculano <iucul...@debian.org> Thu, 19 Aug 2010 11:56:07 +0200
+
lvm2 (2.02.66-2) unstable; urgency=medium
* Make libdevmapper1.02.1 depend on dmsetup. libdevmapper needs new enough
diff -Nru lvm2-2.02.66/debian/patches/CVE-2010-2526.patch lvm2-2.02.66/debian/patches/CVE-2010-2526.patch
--- lvm2-2.02.66/debian/patches/CVE-2010-2526.patch 1970-01-01 01:00:00.000000000 +0100
+++ lvm2-2.02.66/debian/patches/CVE-2010-2526.patch 2010-08-19 11:56:57.000000000 +0200
@@ -0,0 +1,134 @@
+CVE-2010-2526: fix insecure communication between lvm2 and clvmd
+--- a/daemons/clvmd/clvm.h
++++ b/daemons/clvmd/clvm.h
+@@ -45,9 +45,8 @@ struct clvm_header {
+ #define CLVMD_FLAG_SYSTEMLV 2 /* Data in system LV under my node name */
+ #define CLVMD_FLAG_NODEERRS 4 /* Reply has errors in node-specific portion */
+
+-/* Name of the local socket to communicate between libclvm and clvmd */
+-//static const char CLVMD_SOCKNAME[]="/var/run/clvmd";
+-static const char CLVMD_SOCKNAME[] = "\0clvmd";
++/* Name of the local socket to communicate between lvm and clvmd */
++static const char CLVMD_SOCKNAME[]= "/var/run/clvmd.sock";
+
+ /* Internal commands & replies */
+ #define CLVMD_CMD_REPLY 1
+--- a/daemons/clvmd/clvmd.c
++++ b/daemons/clvmd/clvmd.c
+@@ -139,6 +139,7 @@ static void process_remote_command(struc
+ static int process_reply(const struct clvm_header *msg, int msglen,
+ const char *csid);
+ static int open_local_sock(void);
++static void close_local_sock(int local_socket);
+ static int check_local_clvmd(void);
+ static struct local_client *find_client(int clientid);
+ static void main_loop(int local_sock, int cmd_timeout);
+@@ -287,6 +288,14 @@ static const char *decode_cmd(unsigned c
+ return buf;
+ }
+
++static void check_permissions()
++{
++ if (getuid() || geteuid()) {
++ log_error("Cannot run as a non-root user.");
++ exit(4);
++ }
++}
++
+ int main(int argc, char *argv[])
+ {
+ int local_sock;
+@@ -316,6 +325,7 @@ int main(int argc, char *argv[])
+ exit(0);
+
+ case 'R':
++ check_permissions();
+ return refresh_clvmd(1)==1?0:1;
+
+ case 'S':
+@@ -364,6 +374,8 @@ int main(int argc, char *argv[])
+ }
+ }
+
++ check_permissions();
++
+ /* Setting debug options on an existing clvmd */
+ if (debug_opt && !check_local_clvmd()) {
+
+@@ -524,6 +536,7 @@ int main(int argc, char *argv[])
+ /* Do some work */
+ main_loop(local_sock, cmd_timeout);
+
++ close_local_sock(local_sock);
+ destroy_lvm();
+
+ return 0;
+@@ -867,7 +880,6 @@ static void main_loop(int local_sock, in
+
+ closedown:
+ clops->cluster_closedown();
+- close(local_sock);
+ }
+
+ static __attribute__ ((noreturn)) void wait_for_child(int c_pipe, int timeout)
+@@ -1966,20 +1978,30 @@ static int check_local_clvmd(void)
+ return ret;
+ }
+
++static void close_local_sock(int local_socket)
++{
++ if (local_socket != -1 && close(local_socket))
++ stack;
++
++ if (CLVMD_SOCKNAME[0] != '\0' && unlink(CLVMD_SOCKNAME))
++ stack;
++}
+
+ /* Open the local socket, that's the one we talk to libclvm down */
+ static int open_local_sock()
+ {
+- int local_socket;
++ int local_socket = -1;
+ struct sockaddr_un sockaddr;
++ mode_t old_mask;
++
++ close_local_sock(local_socket);
++ old_mask = umask(0077);
+
+ /* Open local socket */
+- if (CLVMD_SOCKNAME[0] != '\0')
+- unlink(CLVMD_SOCKNAME);
+ local_socket = socket(PF_UNIX, SOCK_STREAM, 0);
+ if (local_socket < 0) {
+ log_error("Can't create local socket: %m");
+- return -1;
++ goto error;
+ }
+
+ /* Set Close-on-exec & non-blocking */
+@@ -1992,18 +2014,19 @@ static int open_local_sock()
+ sockaddr.sun_family = AF_UNIX;
+ if (bind(local_socket, (struct sockaddr *) &sockaddr, sizeof(sockaddr))) {
+ log_error("can't bind local socket: %m");
+- close(local_socket);
+- return -1;
++ goto error;
+ }
+ if (listen(local_socket, 1) != 0) {
+ log_error("listen local: %m");
+- close(local_socket);
+- return -1;
++ goto error;
+ }
+- if (CLVMD_SOCKNAME[0] != '\0')
+- chmod(CLVMD_SOCKNAME, 0600);
+
++ umask(old_mask);
+ return local_socket;
++error:
++ close_local_sock(local_socket);
++ umask(old_mask);
++ return -1;
+ }
+
+ void process_message(struct local_client *client, const char *buf, int len,
diff -Nru lvm2-2.02.66/debian/patches/series lvm2-2.02.66/debian/patches/series
--- lvm2-2.02.66/debian/patches/series 2010-06-04 10:24:36.000000000 +0200
+++ lvm2-2.02.66/debian/patches/series 2010-08-19 11:56:57.000000000 +0200
@@ -6,3 +6,4 @@
libdm-atomic.patch
rules-subdir.patch
implicit-pointer.patch
+CVE-2010-2526.patch
signature.asc
Description: Digital signature
