[ioquake3] 02/02: d/patches: Add patches from upstream fixing security vulnerabilities
Simon McVittie
smcv at debian.org
Fri Sep 8 10:33:14 UTC 2017
This is an automated email from the git hooks/post-receive script.
smcv pushed a commit to annotated tag debian/1.36+u20140802+gca9eebb-2+deb8u1
in repository ioquake3.
commit e2af00bd604d2685b4bdce86b3e1208383a65cfc
Author: Simon McVittie <smcv at debian.org>
Date: Tue Mar 14 11:55:27 2017 +0000
d/patches: Add patches from upstream fixing security vulnerabilities
- refuse to load potentially auto-downloadable .pk3 files as
ioquake3 renderers, ioquake3 game code, libcurl, or OpenAL drivers
(mitigation: auto-downloading is off by default, and in Debian
we do not dlopen libcurl anyway)
- refuse to load default configuration file names from a .pk3 file
- protect cl_renderer, cl_curllib, s_aldriver configuration variables so
game code cannot set them
- refuse to overwrite files other than *.txt with the dump console
command
- refuse to overwrite files other than *.cfg with the writeconfig
console command
(Closes: #857699; CVE-2017-6903)
---
debian/changelog | 17 ++++-
...-as-.dlls-and-don-t-load-user-config-file.patch | 76 ++++++++++++++++++++++
.../Don-t-open-.pk3-files-as-OpenAL-drivers.patch | 33 ++++++++++
...file-writing-extension-checks-from-OpenJK.patch | 50 ++++++++++++++
debian/patches/series | 3 +
5 files changed, 177 insertions(+), 2 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index e8d844b..b82eab3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,21 @@
ioquake3 (1.36+u20140802+gca9eebb-2+deb8u1) jessie-security; urgency=high
* d/gbp.conf: switch branch to debian/jessie
-
- -- Simon McVittie <smcv at debian.org> Tue, 14 Mar 2017 11:54:04 +0000
+ * d/patches: Add patches from upstream fixing security vulnerabilities
+ - refuse to load potentially auto-downloadable .pk3 files as
+ ioquake3 renderers, ioquake3 game code, libcurl, or OpenAL drivers
+ (mitigation: auto-downloading is off by default, and in Debian
+ we do not dlopen libcurl anyway)
+ - refuse to load default configuration file names from a .pk3 file
+ - protect cl_renderer, cl_curllib, s_aldriver configuration variables so
+ game code cannot set them
+ - refuse to overwrite files other than *.txt with the dump console
+ command
+ - refuse to overwrite files other than *.cfg with the writeconfig
+ console command
+ (Closes: #857699; CVE-2017-6903)
+
+ -- Simon McVittie <smcv at debian.org> Tue, 14 Mar 2017 22:29:41 +0000
ioquake3 (1.36+u20140802+gca9eebb-2) unstable; urgency=medium
diff --git a/debian/patches/security/Don-t-load-.pk3s-as-.dlls-and-don-t-load-user-config-file.patch b/debian/patches/security/Don-t-load-.pk3s-as-.dlls-and-don-t-load-user-config-file.patch
new file mode 100644
index 0000000..56705a6
--- /dev/null
+++ b/debian/patches/security/Don-t-load-.pk3s-as-.dlls-and-don-t-load-user-config-file.patch
@@ -0,0 +1,76 @@
+From: SmileTheory <SmileTheory at gmail.com>
+Date: Mon, 13 Mar 2017 14:14:00 -0700
+Subject: Don't load .pk3s as .dlls,
+ and don't load user config files from .pk3s.
+
+Origin: upstream, 1.37, commit:376267d534476a875d8b9228149c4ee18b74a4fd
+Bug-Debian: https://bugs.debian.org/857699
+---
+ code/client/cl_main.c | 4 ++--
+ code/qcommon/files.c | 6 ++++++
+ code/sys/sys_main.c | 7 +++++++
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/code/client/cl_main.c b/code/client/cl_main.c
+index 2fa38af..026ebd0 100644
+--- a/code/client/cl_main.c
++++ b/code/client/cl_main.c
+@@ -3179,7 +3179,7 @@ void CL_InitRef( void ) {
+ Com_Printf( "----- Initializing Renderer ----\n" );
+
+ #ifdef USE_RENDERER_DLOPEN
+- cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH);
++ cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED);
+
+ Com_sprintf(dllName, sizeof(dllName), "renderer_%s_" ARCH_STRING DLL_EXT, cl_renderer->string);
+
+@@ -3479,7 +3479,7 @@ void CL_Init( void ) {
+
+ cl_allowDownload = Cvar_Get ("cl_allowDownload", "0", CVAR_ARCHIVE);
+ #ifdef USE_CURL_DLOPEN
+- cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE);
++ cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE | CVAR_PROTECTED);
+ #endif
+
+ cl_conXOffset = Cvar_Get ("cl_conXOffset", "0", 0);
+diff --git a/code/qcommon/files.c b/code/qcommon/files.c
+index b56411c..e82120e 100644
+--- a/code/qcommon/files.c
++++ b/code/qcommon/files.c
+@@ -1344,12 +1344,18 @@ long FS_FOpenFileRead(const char *filename, fileHandle_t *file, qboolean uniqueF
+ {
+ searchpath_t *search;
+ long len;
++ qboolean isLocalConfig;
+
+ if(!fs_searchpaths)
+ Com_Error(ERR_FATAL, "Filesystem call made without initialization");
+
++ isLocalConfig = !strcmp(filename, "autoexec.cfg") || !strcmp(filename, Q3CONFIG_CFG);
+ for(search = fs_searchpaths; search; search = search->next)
+ {
++ // autoexec.cfg and q3config.cfg can only be loaded outside of pk3 files.
++ if (isLocalConfig && search->pack)
++ continue;
++
+ len = FS_FOpenFileReadDir(filename, search, file, uniqueFILE, qfalse);
+
+ if(file == NULL)
+diff --git a/code/sys/sys_main.c b/code/sys/sys_main.c
+index 391ec0b..ee4f911 100644
+--- a/code/sys/sys_main.c
++++ b/code/sys/sys_main.c
+@@ -434,6 +434,13 @@ void *Sys_LoadDll(const char *name, qboolean useSystemLib)
+ {
+ void *dllhandle;
+
++ // Don't load any DLLs that end with the pk3 extension
++ if (COM_CompareExtension(name, ".pk3"))
++ {
++ Com_Printf("Rejecting DLL named \"%s\"", name);
++ return NULL;
++ }
++
+ if(useSystemLib)
+ Com_Printf("Trying to load \"%s\"...\n", name);
+
diff --git a/debian/patches/security/Don-t-open-.pk3-files-as-OpenAL-drivers.patch b/debian/patches/security/Don-t-open-.pk3-files-as-OpenAL-drivers.patch
new file mode 100644
index 0000000..f64792e
--- /dev/null
+++ b/debian/patches/security/Don-t-open-.pk3-files-as-OpenAL-drivers.patch
@@ -0,0 +1,33 @@
+From: SmileTheory <SmileTheory at gmail.com>
+Date: Mon, 13 Mar 2017 20:28:37 -0700
+Subject: Don't open .pk3 files as OpenAL drivers.
+
+Origin: upstream, 1.37, commit:f61fe5f6a0419ef4a88d46a128052f2e8352e85d
+Bug-Debian: https://bugs.debian.org/857699
+---
+ code/client/snd_openal.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/code/client/snd_openal.c b/code/client/snd_openal.c
+index 36f5deb..f828fc5 100644
+--- a/code/client/snd_openal.c
++++ b/code/client/snd_openal.c
+@@ -2512,11 +2512,17 @@ qboolean S_AL_Init( soundInterface_t *si )
+ s_alRolloff = Cvar_Get( "s_alRolloff", "2", CVAR_CHEAT);
+ s_alGraceDistance = Cvar_Get("s_alGraceDistance", "512", CVAR_CHEAT);
+
+- s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH );
++ s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED );
+
+ s_alInputDevice = Cvar_Get( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH );
+ s_alDevice = Cvar_Get("s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH);
+
++ if ( COM_CompareExtension( s_alDriver->string, ".pk3" ) )
++ {
++ Com_Printf( "Rejecting DLL named \"%s\"", s_alDriver->string );
++ return qfalse;
++ }
++
+ // Load QAL
+ if( !QAL_Init( s_alDriver->string ) )
+ {
diff --git a/debian/patches/security/Merge-some-file-writing-extension-checks-from-OpenJK.patch b/debian/patches/security/Merge-some-file-writing-extension-checks-from-OpenJK.patch
new file mode 100644
index 0000000..1f10968
--- /dev/null
+++ b/debian/patches/security/Merge-some-file-writing-extension-checks-from-OpenJK.patch
@@ -0,0 +1,50 @@
+From: SmileTheory <SmileTheory at gmail.com>
+Date: Mon, 13 Mar 2017 20:44:47 -0700
+Subject: Merge some file writing extension checks from OpenJK.
+
+Thanks Ensiform.
+https://github.com/JACoders/OpenJK/commit/05928a57f9e4aae15a3bd0
+https://github.com/JACoders/OpenJK/commit/ef124fd0fc48af164581176
+
+Origin: upstream, 1.37, commit:b173ac05993f634a42be3d3535e1b158de0c3372
+Bug-Debian: https://bugs.debian.org/857699
+---
+ code/client/cl_console.c | 6 ++++++
+ code/qcommon/common.c | 7 +++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/code/client/cl_console.c b/code/client/cl_console.c
+index a3d4d32..7de318d 100644
+--- a/code/client/cl_console.c
++++ b/code/client/cl_console.c
+@@ -191,6 +191,12 @@ void Con_Dump_f (void)
+ Q_strncpyz( filename, Cmd_Argv( 1 ), sizeof( filename ) );
+ COM_DefaultExtension( filename, sizeof( filename ), ".txt" );
+
++ if (!COM_CompareExtension(filename, ".txt"))
++ {
++ Com_Printf("Con_Dump_f: Only the \".txt\" extension is supported by this command!\n");
++ return;
++ }
++
+ f = FS_FOpenFileWrite( filename );
+ if (!f)
+ {
+diff --git a/code/qcommon/common.c b/code/qcommon/common.c
+index 36cb4ce..309be1f 100644
+--- a/code/qcommon/common.c
++++ b/code/qcommon/common.c
+@@ -2961,6 +2961,13 @@ void Com_WriteConfig_f( void ) {
+ return;
+ }
+
++
++ if (!COM_CompareExtension(filename, ".cfg"))
++ {
++ Com_Printf("Com_WriteConfig_f: Only the \".cfg\" extension is supported by this command!\n");
++ return;
++ }
++
+ Q_strncpyz( filename, Cmd_Argv(1), sizeof( filename ) );
+ COM_DefaultExtension( filename, sizeof( filename ), ".cfg" );
+ Com_Printf( "Writing %s.\n", filename );
diff --git a/debian/patches/series b/debian/patches/series
index fd1716f..ec2b204 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,6 @@ Add-sv_dorestart-which-can-be-set-by-game-code-to-re.patch
Let-servers-set-sv_fps-too.patch
Run-in-a-window-by-default-on-new-installations.patch
Add-support-for-the-GNU-Hurd-architecture.patch
+security/Don-t-load-.pk3s-as-.dlls-and-don-t-load-user-config-file.patch
+security/Don-t-open-.pk3-files-as-OpenAL-drivers.patch
+security/Merge-some-file-writing-extension-checks-from-OpenJK.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-games/ioquake3.git
More information about the Pkg-games-commits
mailing list