a71a57
From d9d5fea585b23991f76532a9b07de7fcd3b649f4 Mon Sep 17 00:00:00 2001
a71a57
From: Graham Dumpleton <Graham.Dumpleton@gmail.com>
a71a57
Date: Wed, 21 May 2014 16:16:47 +1000
a71a57
Subject: [PATCH] Local privilege escalation when using daemon mode.
a71a57
 (CVE-2014-0240)
a71a57
a71a57
---
a71a57
 mod_wsgi.c | 13 +++++++++++++
a71a57
 1 file changed, 13 insertions(+)
a71a57
a71a57
diff --git a/mod_wsgi.c b/mod_wsgi.c
a71a57
index 32b2903..3ef911b 100644
a71a57
--- a/mod_wsgi.c
a71a57
+++ b/mod_wsgi.c
a71a57
@@ -10756,6 +10756,19 @@ static void wsgi_setup_access(WSGIDaemonProcess *daemon)
a71a57
         ap_log_error(APLOG_MARK, WSGI_LOG_ALERT(errno), wsgi_server,
a71a57
                      "mod_wsgi (pid=%d): Unable to change to uid=%ld.",
a71a57
                      getpid(), (long)daemon->group->uid);
a71a57
+
a71a57
+        /*
a71a57
+         * On true UNIX systems this should always succeed at
a71a57
+         * this point. With certain Linux kernel versions though
a71a57
+         * we can get back EAGAIN where the target user had
a71a57
+         * reached their process limit. In that case will be left
a71a57
+         * running as wrong user. Just exit on all failures to be
a71a57
+         * safe. Don't die immediately to avoid a fork bomb.
a71a57
+         */
a71a57
+
a71a57
+        sleep(20);
a71a57
+
a71a57
+        exit(-1);
a71a57
     }
a71a57
 
a71a57
 #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
a71a57
-- 
a71a57
2.0.3
a71a57