diff --git a/SOURCES/telnet-0.17-pty-retry.patch b/SOURCES/telnet-0.17-pty-retry.patch new file mode 100644 index 0000000..0d787f4 --- /dev/null +++ b/SOURCES/telnet-0.17-pty-retry.patch @@ -0,0 +1,42 @@ +--- a/telnetd/telnetd.c ++++ b/telnetd/telnetd.c +@@ -772,7 +772,6 @@ void telnet(int f, int p) + int on = 1; + char *HE; + const char *IM; +- int pty_read_ok = 0; /* track whether the pty read has worked yet */ + + /* + * Initialize the slc mapping table. +@@ -1086,19 +1085,24 @@ void telnet(int f, int p) + * Something to read from the pty... + */ + if (FD_ISSET(p, &ibits)) { ++ int eio = 0; ++read_pty: + pcc = read(p, ptyibuf, BUFSIZ); +- /* +- * On some systems, if we try to read something +- * off the master side before the slave side is +- * opened, we get EIO. +- */ +- if (pcc < 0 && (errno == EWOULDBLOCK || (errno == EIO && pty_read_ok == 0))) { ++ if (pcc < 0 && errno == EWOULDBLOCK) { + pcc = 0; + } ++ /* ++ * If we try to read something off the master side while the slave ++ * side is temporarily closed by login process, we get EIO. ++ */ ++ else if (pcc < 0 && errno == EIO && eio < 1000) { ++ eio++; ++ poll(NULL, 0, 10); ++ goto read_pty; ++ } + else { + if (pcc <= 0) + break; +- pty_read_ok = 1; /* mark connection up for read */ + #ifdef LINEMODE + /* + * If ioctl from pty, pass it through net diff --git a/SPECS/telnet.spec b/SPECS/telnet.spec index d66508b..fde4d27 100644 --- a/SPECS/telnet.spec +++ b/SPECS/telnet.spec @@ -3,7 +3,7 @@ Summary: The client program for the Telnet remote login protocol Name: telnet Version: 0.17 -Release: 65%{?dist} +Release: 66%{?dist} Epoch: 1 License: BSD Group: Applications/Internet @@ -39,6 +39,7 @@ Patch27: telnet-log-address.patch Patch28: telnet-0.17-force-ipv6-ipv4.patch Patch29: netkit-telnet-0.17-manpage.patch Patch30: telnet-0.17-overflow-exploit.patch +Patch31: telnet-0.17-pty-retry.patch BuildRequires: ncurses-devel systemd @@ -92,6 +93,7 @@ mv telnet telnet-NETKIT %patch28 -p1 -b .ipv6-support %patch29 -p1 -b .manpage %patch30 -p1 -b .overflow +%patch31 -p1 -b .pty-retry %build %ifarch s390 s390x @@ -157,8 +159,11 @@ install -p -m644 %SOURCE6 ${RPM_BUILD_ROOT}%{_unitdir}/telnet.socket %{_mandir}/man8/telnetd.8* %changelog +* Tue Sep 22 2020 Michal Ruprich - 1:0.17-66 +- Resolves: #1853102 - in.telnetd needs to tolerate temporary EIO errors + * Thu Mar 26 2020 Michal Ruprich - 1:0.17-65 -- Resolves: #1814475 - Arbitrary remote code execution in utility.c via short writes or urgent data +- Resolves: #1814476 - Arbitrary remote code execution in utility.c via short writes or urgent data * Wed Apr 19 2017 Michal Ruprich - 1:0.17-64 - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used