From 0c61964bd9be18fe635c829197cd28bde68f8e98 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Thu, 18 Jun 2026 03:19:31 +0800 Subject: [PATCH] Fix CVE-2026-10294: Do not accept symlinks as frontend socket If a debconf frontend socket is passed, we now ensure that it isn't a symlink and is a socket, instead of following it and revealing that the symlink exists. This prevents unprivileged users from probing the existence of arbitrary files on the system via the SetHints frontend-socket argument. Upstream: https://github.com/PackageKit/PackageKit/commit/4c1994d0545dea8a66cc56d9457ff740965abaf0 Generated-By: deepin-ci-robot Co-Authored-By: hudeng --- debian/changelog | 9 +++++ debian/patches/CVE-2026-10294.patch | 52 +++++++++++++++++++++++++++++ debian/patches/series | 3 ++ 3 files changed, 64 insertions(+) create mode 100644 debian/patches/CVE-2026-10294.patch diff --git a/debian/changelog b/debian/changelog index 5f57127..cd8df17 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +packagekit (1.2.8-2deepin3) unstable; urgency=medium + + * Fix CVE-2026-10294: Do not accept symlinks as frontend socket to + prevent unauthorized file probing via SetHints frontend-socket + argument + + -- deepin-ci-robot Thu, 18 Jun 2026 03:18:35 +0800 + + packagekit (1.2.8-2deepin2) unstable; urgency=medium * Do not allow re-invoking methods on non-new transactions diff --git a/debian/patches/CVE-2026-10294.patch b/debian/patches/CVE-2026-10294.patch new file mode 100644 index 0000000..0f35137 --- /dev/null +++ b/debian/patches/CVE-2026-10294.patch @@ -0,0 +1,52 @@ +Description: Do not accept symlinks as frontend socket + If a debconf frontend socket is passed, we now ensure that it isn't a + symlink and is a socket, instead of following it and revealing that the + symlinked file exists (CVE-2026-10294). +Author: Corentin Noël +Origin: upstream, https://github.com/PackageKit/PackageKit/commit/4c1994d0545dea8a66cc56d9457ff740965abaf0 +Bug: https://github.com/PackageKit/PackageKit/issues/969 +Last-Update: 2026-06-18 + +--- a/src/pk-transaction.c ++++ b/src/pk-transaction.c +@@ -4797,6 +4797,7 @@ pk_transaction_set_hint (PkTransaction *transaction, + + /* frontend_socket=/tmp/socket.3456 */ + if (g_strcmp0 (key, "frontend-socket") == 0) { ++ GStatBuf st; + + /* nothing provided */ + if (value == NULL || value[0] == '\0') { +@@ -4816,14 +4817,24 @@ pk_transaction_set_hint (PkTransaction *transaction, + return FALSE; + } + +- /* socket does not exist */ +- if (!g_file_test (value, G_FILE_TEST_EXISTS)) { +- g_set_error_literal (error, +- PK_TRANSACTION_ERROR, +- PK_TRANSACTION_ERROR_NOT_SUPPORTED, +- "frontend-socket does not exist"); +- return FALSE; +- } ++ /* must be an actual socket and must not be a symlink: ++ * lstat() doesn't follow symlinks (which would let callers ++ * probe arbitrary paths as root), and allows us to reject ++ * anything that is not a Unix socket */ ++ if (g_lstat (value, &st) != 0) { ++ g_set_error_literal (error, ++ PK_TRANSACTION_ERROR, ++ PK_TRANSACTION_ERROR_NO_SUCH_FILE, ++ "frontend-socket does not exist"); ++ return FALSE; ++ } ++ if (!S_ISSOCK (st.st_mode)) { ++ g_set_error_literal (error, ++ PK_TRANSACTION_ERROR, ++ PK_TRANSACTION_ERROR_INPUT_INVALID, ++ "frontend-socket is not a socket"); ++ return FALSE; ++ } + + /* success */ + pk_backend_job_set_frontend_socket (priv->job, value); diff --git a/debian/patches/series b/debian/patches/series index ae43f43..6a950cc 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -3,3 +3,6 @@ policy.diff 02_identify-ubuntu.patch 03_not_call_dbus_on_ostree_booted_systems.patch PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch + +# CVE-2026-10294 +CVE-2026-10294.patch