[packages/pam] fix CVE-2024-10963 and unbreak the build (release 2)
arekm
arekm at pld-linux.org
Tue Aug 18 09:24:48 CEST 2026
commit 29b24d6f1afd4a9574d15700c39e0cf43a78687d
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Tue Aug 18 09:19:13 2026 +0200
fix CVE-2024-10963 and unbreak the build (release 2)
pam-memset_explicit-args.patch | 11 ++
pam.spec | 8 +-
pam_access-rework-hostname-tokens.patch | 223 ++++++++++++++++++++++++++++++++
pam_pwgen-const-argv.patch | 11 ++
4 files changed, 252 insertions(+), 1 deletion(-)
---
diff --git a/pam.spec b/pam.spec
index b38a2e2..bfb2817 100644
--- a/pam.spec
+++ b/pam.spec
@@ -24,7 +24,7 @@ Summary(tr.UTF-8): Modüler, artımsal doğrulama birimleri
Summary(uk.UTF-8): Інструмент, що забезпечує аутентифікацію для програм
Name: pam
Version: 1.6.0
-Release: 1
+Release: 2
Epoch: 1
# The library is BSD licensed with option to relicense as GPLv2+
# - this option is redundant as the BSD license allows that anyway.
@@ -48,6 +48,9 @@ Patch1: %{name}_console-lex-static.patch
Patch3: %{name}-mkhomedir-notfound.patch
Patch5: %{name}-exec-failok.patch
Patch6: pam_console_pam_tty.patch
+Patch7: pam_access-rework-hostname-tokens.patch
+Patch8: pam-memset_explicit-args.patch
+Patch9: pam_pwgen-const-argv.patch
URL: http://www.linux-pam.org/
%{?with_audit:BuildRequires: audit-libs-devel >= 1.6.9}
BuildRequires: autoconf >= 2.61
@@ -266,6 +269,9 @@ danych GDBM.
%patch -P3 -p1
%patch -P5 -p1
%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
%build
%{__libtoolize}
diff --git a/pam-memset_explicit-args.patch b/pam-memset_explicit-args.patch
new file mode 100644
index 0000000..a084339
--- /dev/null
+++ b/pam-memset_explicit-args.patch
@@ -0,0 +1,11 @@
+--- Linux-PAM-1.6.0.orig/libpam/include/pam_inline.h
++++ Linux-PAM-1.6.0/libpam/include/pam_inline.h
+@@ -82,7 +82,7 @@ pam_str_skip_icase_prefix_len(const char
+ static inline void pam_overwrite_n(void *ptr, size_t len)
+ {
+ if (ptr)
+- memset_explicit(ptr, len);
++ memset_explicit(ptr, 0, len);
+ }
+ #elif defined HAVE_EXPLICIT_BZERO
+ static inline void pam_overwrite_n(void *ptr, size_t len)
diff --git a/pam_access-rework-hostname-tokens.patch b/pam_access-rework-hostname-tokens.patch
new file mode 100644
index 0000000..f08cf0a
--- /dev/null
+++ b/pam_access-rework-hostname-tokens.patch
@@ -0,0 +1,223 @@
+From: Thorsten Kukuk <kukuk at suse.com>
+Date: Thu, 14 Nov 2024 10:27:28 +0100
+Subject: pam_access: rework resolving of tokens as hostname
+
+* modules/pam_access/pam_access.c: separate resolving of IP addresses
+ from hostnames. Don't resolve TTYs or display variables as hostname
+ (#834).
+ Add "nodns" option to disallow resolving of tokens as hostname.
+* modules/pam_access/pam_access.8.xml: document nodns option
+* modules/pam_access/access.conf.5.xml: document that hostnames should
+ be written as FQHN.
+
+(cherry picked from commit 940747f88c16e029b69a74e80a2e94f65cb3e628)
+---
+ modules/pam_access/access.conf.5.xml | 4 ++
+ modules/pam_access/pam_access.8.xml | 46 +++++++++++++++--------
+ modules/pam_access/pam_access.c | 72 +++++++++++++++++++++++++++++++++++-
+ 3 files changed, 105 insertions(+), 17 deletions(-)
+
+diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml
+index 65c6b69..67e5354 100644
+--- a/modules/pam_access/access.conf.5.xml
++++ b/modules/pam_access/access.conf.5.xml
+@@ -233,6 +233,10 @@
+ An IPv6 link local host address must contain the interface
+ identifier. IPv6 link local network/netmask is not supported.
+ </para>
++ <para>
++ Hostnames should be written as Fully-Qualified Host Name (FQHN) to avoid
++ confusion with device names or PAM service names.
++ </para>
+ </refsect1>
+
+ <refsect1 xml:id="access.conf-see_also">
+diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml
+index dcc5039..d907b80 100644
+--- a/modules/pam_access/pam_access.8.xml
++++ b/modules/pam_access/pam_access.8.xml
+@@ -22,11 +22,14 @@
+ <arg choice="opt" rep="norepeat">
+ debug
+ </arg>
++ <arg choice="opt" rep="norepeat">
++ noaudit
++ </arg>
+ <arg choice="opt" rep="norepeat">
+ nodefgroup
+ </arg>
+ <arg choice="opt" rep="norepeat">
+- noaudit
++ nodns
+ </arg>
+ <arg choice="opt" rep="norepeat">
+ quiet_log
+@@ -132,6 +135,33 @@
+ </listitem>
+ </varlistentry>
+
++ <varlistentry>
++ <term>
++ nodefgroup
++ </term>
++ <listitem>
++ <para>
++ User tokens which are not enclosed in parentheses will not be
++ matched against the group database. The backwards compatible default is
++ to try the group database match even for tokens not enclosed
++ in parentheses.
++ </para>
++ </listitem>
++ </varlistentry>
++
++ <varlistentry>
++ <term>
++ nodns
++ </term>
++ <listitem>
++ <para>
++ Do not try to resolve tokens as hostnames, only IPv4 and IPv6
++ addresses will be resolved. Which means to allow login from a
++ remote host, the IP addresses need to be specified in <filename>access.conf</filename>.
++ </para>
++ </listitem>
++ </varlistentry>
++
+ <varlistentry>
+ <term>
+ quiet_log
+@@ -185,20 +215,6 @@
+ </listitem>
+ </varlistentry>
+
+- <varlistentry>
+- <term>
+- nodefgroup
+- </term>
+- <listitem>
+- <para>
+- User tokens which are not enclosed in parentheses will not be
+- matched against the group database. The backwards compatible default is
+- to try the group database match even for tokens not enclosed
+- in parentheses.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+ </variablelist>
+ </refsect1>
+
+diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
+index 11f6b92..15acbf9 100644
+--- a/modules/pam_access/pam_access.c
++++ b/modules/pam_access/pam_access.c
+@@ -100,6 +100,7 @@ struct login_info {
+ int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */
+ int noaudit; /* Do not audit denials */
+ int quiet_log; /* Do not log denials */
++ int nodns; /* Do not try to resolve tokens as hostnames */
+ const char *fs; /* field separator */
+ const char *sep; /* list-element separator */
+ int from_remote_host; /* If PAM_RHOST was used for from */
+@@ -154,6 +155,8 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo,
+ loginfo->noaudit = YES;
+ } else if (strcmp (argv[i], "quiet_log") == 0) {
+ loginfo->quiet_log = YES;
++ } else if (strcmp (argv[i], "nodns") == 0) {
++ loginfo->nodns = YES;
+ } else {
+ pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]);
+ }
+@@ -820,7 +823,7 @@ remote_match (pam_handle_t *pamh, char *tok, struct login_info *item)
+ if ((str_len = strlen(string)) > tok_len
+ && strcasecmp(tok, string + str_len - tok_len) == 0)
+ return YES;
+- } else if (tok[tok_len - 1] == '.') { /* internet network numbers (end with ".") */
++ } else if (tok[tok_len - 1] == '.') { /* internet network numbers/subnet (end with ".") */
+ struct addrinfo hint;
+
+ memset (&hint, '\0', sizeof (hint));
+@@ -895,6 +898,39 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string,
+ }
+
+
++static int
++is_device (pam_handle_t *pamh, const char *tok)
++{
++ struct stat st;
++ const char *dev = "/dev/";
++ char *devname;
++
++ devname = malloc (strlen(dev) + strlen (tok) + 1);
++ if (devname == NULL) {
++ pam_syslog(pamh, LOG_ERR, "Cannot allocate memory for device name: %m");
++ /*
++ * We should return an error and abort, but pam_access has no good
++ * error handling.
++ */
++ return NO;
++ }
++
++ char *cp = stpcpy (devname, dev);
++ strcpy (cp, tok);
++
++ if (lstat(devname, &st) != 0)
++ {
++ free (devname);
++ return NO;
++ }
++ free (devname);
++
++ if (S_ISCHR(st.st_mode))
++ return YES;
++
++ return NO;
++}
++
+ /* network_netmask_match - match a string against one token
+ * where string is a hostname or ip (v4,v6) address and tok
+ * represents either a hostname, a single ip (v4,v6) address
+@@ -956,10 +992,42 @@ network_netmask_match (pam_handle_t *pamh,
+ return NO;
+ }
+ }
++ else if (isipaddr(tok, NULL, NULL) == YES)
++ {
++ if (getaddrinfo (tok, NULL, NULL, &ai) != 0)
++ {
++ if (item->debug)
++ pam_syslog(pamh, LOG_DEBUG, "cannot resolve IP address \"%s\"", tok);
++
++ return NO;
++ }
++ netmask_ptr = NULL;
++ }
++ else if (item->nodns)
++ {
++ /* Only hostnames are left, which we would need to resolve via DNS */
++ return NO;
++ }
+ else
+ {
++ /* Bail out on X11 Display entries and ttys. */
++ if (tok[0] == ':')
++ {
++ if (item->debug)
++ pam_syslog (pamh, LOG_DEBUG,
++ "network_netmask_match: tok=%s is X11 display", tok);
++ return NO;
++ }
++ if (is_device (pamh, tok))
++ {
++ if (item->debug)
++ pam_syslog (pamh, LOG_DEBUG,
++ "network_netmask_match: tok=%s is a TTY", tok);
++ return NO;
++ }
++
+ /*
+- * It is either an IP address or a hostname.
++ * It is most likely a hostname.
+ * Let getaddrinfo sort everything out
+ */
+ if (getaddrinfo (tok, NULL, NULL, &ai) != 0)
diff --git a/pam_pwgen-const-argv.patch b/pam_pwgen-const-argv.patch
new file mode 100644
index 0000000..e899bf1
--- /dev/null
+++ b/pam_pwgen-const-argv.patch
@@ -0,0 +1,11 @@
+--- Linux-PAM-1.6.0.orig/modules/pam_pwgen/pam_pwgen_app.c
++++ Linux-PAM-1.6.0/modules/pam_pwgen/pam_pwgen_app.c
+@@ -323,7 +323,7 @@ int main(int argc, const char **argv)
+ int genpw;
+ struct tris_data *tr;
+ struct stat st;
+- char **av;
++ const char **av;
+
+ strcpy(tri_file, DEFAULT_TRIGRAM_FILE);
+
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/pam.git/commitdiff/29b24d6f1afd4a9574d15700c39e0cf43a78687d
More information about the pld-cvs-commit
mailing list