FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

[Dag-Erling Smørgrav]

Bruce Evans <bde at zeta.org.au> writes:
> Dag-Erling Smørgrav <des at des.no> writes:
> % Index: sys/kern/vfs_lookup.c
> % ===================================================================
> % --- sys/kern/vfs_lookup.c	(revision 192899)
> % +++ sys/kern/vfs_lookup.c	(working copy)
> % @@ -147,6 +147,9 @@
> %  		cnp->cn_flags &= ~LOCKSHARED;
> %  	fdp = p->p_fd;
> % % +	/* We will set this ourselves if we need it. */
> % +	cnp->cn_flags &= ~TRAILINGSLASH;
> % +
>
> Can TRAILINGSLASH ever be set here?  Is namei() ever called recursively?

"suspenders and a belt"

It is hypothetically possible for the caller to have set it.

> %  	/*
> %  	 * Get a buffer for the name to be translated, and copy the
> %  	 * name into the buffer.
> % @@ -533,6 +536,8 @@
> %  		if (*cp == '\0') {
> %  			trailing_slash = 1;
>
> I thought at first that this flag can go away.

I intend to remove it later - I just wanted to get the bug fixed first.
I'm happy to hear that removing it will fix the two bugs introduced by
the patch I committed :)

DES
-- 
Dag-Erling Smørgrav - des at des.no