upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

tcp: apply CLOEXEC to accepted socket, not listener

Browse source 
The accept path calls set_cloexec(sd) after accept(). That re-flags the
listening socket, which is already CLOEXEC from create_socket_tcp(), and
leaves new_sd inheritable. As a result, client-connect and auth scripts
spawned after accept can inherit the connected socket and read or write
the raw TCP stream. This defeats the stated intent to prevent scripts from
accessing the client socket.

This bug was found using ZeroPath.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <-MNw5Hu8h0rHV18x36ISt7V0UHchIO4i-JoAeV_wlxS1AmDIAe7YVYNput3_r2hiu3HhwxkhGyUhv4-iH_E7mf7nGjvocmGXlDq7Tjly5cE=@joshua.hu>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33823.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Joshua Rogers 2025-10-22 01:20:52 +08:00 committed by Gert Doering
parent b9b5470521
commit c0d96fd873
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/openvpn/socket.c
View file

@ -836,7 +836,7 @@ socket_do_accept(socket_descriptor_t sd, struct link_socket_actual *act, const b
{
/* set socket file descriptor to not pass across execs, so that
* scripts don't have access to it */
set_cloexec(sd);
set_cloexec(new_sd);
}
return new_sd;
}