From nobody Tue Aug 09 20:00:25 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4M2P7Z211Cz3j8KK; Tue, 9 Aug 2022 20:00:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4M2P7Z0LVSz3jst; Tue, 9 Aug 2022 20:00:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1660075226; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7RxgwjZviXVgJ4t1c/kLHHwE7kqOb13SndXJLplzuRU=; b=EhbbbpNRqThlZpeh4HZifsAMV2HH93A0T5MXRg47nXACtWBl+3qBS8NtByVP4hvOMUoBGF VUDfj2Sjb9jBYt/1fgOFGprvhv94EFwtSz6T9N0TcU6Ptf47tkO+FYUqohhvoTptA3JyOo bvxgN6JpoblpfQzhSqD41YPjE/pv9WbobLBSve2/p04Gs3A/aWzYc+/zfN14rJw6O3G9Se NBNJ7JNi9kUEVu7uUfkRcgV/UF+CsGsK5bNNo6WV54ACUQ1eeEJsHXrdG/cyhQ8S44jxFw VJ7z4j6256zBKvyRMrZhCt09SuZdnIHPTE+xLFCE+tCNmtx9hej09agGA4PqOg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4M2P7Y6YvNzkFr; Tue, 9 Aug 2022 20:00:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 279K0P6L030936; Tue, 9 Aug 2022 20:00:25 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 279K0PfW030935; Tue, 9 Aug 2022 20:00:25 GMT (envelope-from git) Date: Tue, 9 Aug 2022 20:00:25 GMT Message-Id: <202208092000.279K0PfW030935@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 277c0c4d2512 - releng/13.0 - pam_exec: fix segfault when authtok is null List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/13.0 X-Git-Reftype: branch X-Git-Commit: 277c0c4d2512228bfd25e762cc1517b216a37238 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1660075226; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7RxgwjZviXVgJ4t1c/kLHHwE7kqOb13SndXJLplzuRU=; b=N/2wBBc6s0R6pr6wzkckQOWvOEift/ps5cZWT3pjVKZC7ddm0Ham6IvH0PqMBm2PqZP7Nu vS23tFFmk6ydyIRSH2E7EwwZQQc2cLTQexEju4kWDthTRoB/jP75Nu3+Vxk2S0mFhI7JOh igqLc3HErFWYF69TZkbXzZK6IBLkDdoz7sMjXCppWKnFiidI1mTfqrDzLjBkEeB1yPSKCu BPZesIpC1pJkS6MKVAJ/jSaaNXzrzg2nrZbwSEam1V5W0O90Ahs6NSsGANJ2BKnn5+d6lM uX4TDbKm0qH24eYIpvcfvbvxt05491SYBCk373QuSD1B2dOtsQIHkzdUOZBrtQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1660075226; a=rsa-sha256; cv=none; b=bIK2ueCi2PuzfwQkPh4sjdoSNaJSBjVYzvSz79jA2ygqpvt8USpxyqYmfCJVCjWXV4wGZy i+TA0mVJdvKsMVMvT+TMjbACdiSgg6N9jku2UuT6iYNXr9rmZMYU0Qwfl5P1nim/0q8UP9 nx865xL1tpBF5BjpJYoPUvu3GLAyqbB5jDSkewgaX4edC3EF7IcQuf+YjkqYDvHnlmwBUz L7tV+yb5n5bxj3Oly3RkLL2AkqJTI9kn559AfYbKTNkZcB6daaSvGkgyuO1a+EK2l7uLA5 T78l8pnmR5UkzSxYPVSBrCZX0hzpqn1b3qcHqFQrtSJuF/lOZi699nv+dFw/gg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch releng/13.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=277c0c4d2512228bfd25e762cc1517b216a37238 commit 277c0c4d2512228bfd25e762cc1517b216a37238 Author: Yan Ka Chiu AuthorDate: 2022-05-22 16:33:02 +0000 Commit: Mark Johnston CommitDate: 2022-07-25 21:08:46 +0000 pam_exec: fix segfault when authtok is null According to pam_exec(8), the `expose_authtok` option should be ignored when the service function is `pam_sm_setcred`. Currently `pam_exec` only prevent prompt for anth token when `expose_authtok` is set on `pam_sm_setcred`. This subsequently led to segfault when there isn't an existing auth token available. Bug reported on this: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263893 After reading https://reviews.freebsd.org/rS349556 I am not sure if the default behaviour supposed to be simply not prompt for authentication token, or is it to ignore the option entirely as stated in the man page. This patch is therefore only adding an additional NULL check on the item `pam_get_item` provide, and exit with `PAM_SYSTEM_ERR` when such item is NULL. Approved by: so Security: FreeBSD-EN-22:19.pam_exec MFC after: 1 week Reviewed by: des, khng Differential Revision: https://reviews.freebsd.org/D35169 (cherry picked from commit b75e0eed345d2ab047a6b1b00a9a7c3bf92e992c) (cherry picked from commit ea80848e1c0639e2ac8d3f974ddb9c6233491eb3) --- lib/libpam/modules/pam_exec/pam_exec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/libpam/modules/pam_exec/pam_exec.c b/lib/libpam/modules/pam_exec/pam_exec.c index b8f2e1d8fdfc..ef2680d80525 100644 --- a/lib/libpam/modules/pam_exec/pam_exec.c +++ b/lib/libpam/modules/pam_exec/pam_exec.c @@ -261,6 +261,13 @@ _pam_exec(pam_handle_t *pamh, /* don't prompt, only expose existing token */ rc = pam_get_item(pamh, PAM_AUTHTOK, &item); authtok = item; + if (authtok == NULL && rc == PAM_SUCCESS) { + openpam_log(PAM_LOG_ERROR, + "%s: pam_get_authtok(): %s", + func, "authentication token not available"); + OUT(PAM_SYSTEM_ERR); + } + } else { rc = pam_get_authtok(pamh, PAM_AUTHTOK, &authtok, NULL); }