From 308c40306db937dda0ed99c7a426c7730c3d326c Mon Sep 17 00:00:00 2001 From: liuxinhao Date: Mon, 14 Nov 2022 16:50:36 +0800 Subject: [PATCH] fix(CVE): PAM authorization bypass due to incorrect usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 修复问题: 已经过期的账户持有凭证仍然能登录 --- libexec/session-guard-checkpass/main.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libexec/session-guard-checkpass/main.cpp b/libexec/session-guard-checkpass/main.cpp index e667bde..4606411 100644 --- a/libexec/session-guard-checkpass/main.cpp +++ b/libexec/session-guard-checkpass/main.cpp @@ -203,7 +203,6 @@ int main(int argc, char *argv[]) int authRes = PAM_SUCCESS; authRes = pam_authenticate(pamh, 0); - const char *newUserName; if (pam_get_item(pamh, PAM_USER, (const void **)&newUserName) != PAM_SUCCESS) { @@ -211,6 +210,11 @@ int main(int argc, char *argv[]) return EXIT_FAILURE; } + if( authRes == PAM_SUCCESS ) + { + authRes = pam_acct_mgmt(pamh, 0); + } + const char *authResultString = pam_strerror(pamh, authRes); CompleteEvent event(true, authRes == PAM_SUCCESS, QString(authResultString)); kiran_pam_message_send_event(CHANNEL_WRITE, &event); -- 2.33.0