From 954eddd0b8c25424fd44bbd002ba36873fe2c8d4 Mon Sep 17 00:00:00 2001 From: Gary Lockyer Date: Mon, 11 Dec 2017 09:17:49 +1300 Subject: [PATCH] lib/tevent/echo_server.c set socket close on exec Set SOCKET_CLOEXEC on the sockets returned by accept. This ensures that the socket is unavailable to any child process created by system(). Making it harder for malicious code to set up a command channel, as seen in the exploit for CVE-2015-0240 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett --- lib/tevent/echo_server.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/tevent/echo_server.c b/lib/tevent/echo_server.c index 6e7f1811f42f..3b2122dac114 100644 --- a/lib/tevent/echo_server.c +++ b/lib/tevent/echo_server.c @@ -118,6 +118,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde, tevent_req_error(req, errno); return; } + smb_set_close_on_exec(state->listen_sock); state->sock = ret; tevent_req_done(req); } -- 2.34.1