From 08a80b7b009feb1334dfb764ab25641ecda3f1dd Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 18 Feb 2022 19:49:52 +0100 Subject: [PATCH] polkit: Patch unauthenticated file descriptor leak https://gitlab.freedesktop.org/polkit/polkit/-/issues/170 https://www.openwall.com/lists/oss-security/2022/02/18/1 Fixes: CVE-2021-4115 --- pkgs/development/libraries/polkit/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix index 3a3199cbd7a..72907f7aedc 100644 --- a/pkgs/development/libraries/polkit/default.nix +++ b/pkgs/development/libraries/polkit/default.nix @@ -65,6 +65,12 @@ stdenv.mkDerivation rec { url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch"; sha256 = "162jkpg2myq0rb0s5k3nfr4pqwv9im13jf6vzj8p5l39nazg5i4s"; }) + # File descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115) + (fetchpatch { + name = "CVE-2021-4115.patch"; + url = "https://src.fedoraproject.org/rpms/polkit/raw/0a203bd46a1e2ec8cc4b3626840e2ea9d0d13a9a/f/CVE-2021-4115.patch"; + sha256 = "sha256-BivHVVpYB4Ies1YbBDyKwUmNlqq2D1MpMipH9/dZM54="; + }) ] ++ lib.optionals stdenv.hostPlatform.isMusl [ # Make netgroup support optional (musl does not have it) # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10