27 lines
825 B
Diff
27 lines
825 B
Diff
From 6de3c05eb6cbb0e98c64bb92bc848a99436c363c Mon Sep 17 00:00:00 2001
|
|
From: bwzhang <zhangbowei@kylinos.cn>
|
|
Date: Wed, 13 Mar 2024 09:39:27 +0800
|
|
Subject: [PATCH] fix CVE-2022-4318
|
|
|
|
---
|
|
server/container_create.go | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/server/container_create.go b/server/container_create.go
|
|
index 520efc7..30f9ba5 100644
|
|
--- a/server/container_create.go
|
|
+++ b/server/container_create.go
|
|
@@ -196,6 +196,9 @@ func setupContainerUser(ctx context.Context, specgen *generate.Generator, rootfs
|
|
for _, env := range specgen.Config.Process.Env {
|
|
if strings.HasPrefix(env, "HOME=") {
|
|
homedir = strings.TrimPrefix(env, "HOME=")
|
|
+ if idx := strings.Index(homedir, `\n`); idx > -1 {
|
|
+ return fmt.Errorf("invalid HOME environment; newline not allowed")
|
|
+ }
|
|
break
|
|
}
|
|
}
|
|
--
|
|
2.20.1
|
|
|