From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Vitezslav Crhonek To: git-commits@fedoraproject.org Subject: [rpms/kbd] f44: Fix openvt -u process matching to be more conservative (CVE-2026-72693) Date: Thu, 27 Aug 2026 07:58:47 GMT Message-ID: <178781752798.1.3515362111105326990.rpms-kbd-7d67a223f0ea@fedoraproject.org> List-ID: X-Git-Repo: rpms/kbd X-Git-Branch: f44 X-Git-Rev: 7d67a223f0ea2d75742c9ddaf23711c75aafbab9 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMva2JkCkJyYW5jaCA6 IGY0NApDb21taXQgOiA3ZDY3YTIyM2YwZWEyZDc1NzQyYzlkZGFmMjM3MTFjNzVhYWZiYWI5CkF1 dGhvciA6IFZpdGV6c2xhdiBDcmhvbmVrIDx2Y3Job25la0ByZWRoYXQuY29tPgpEYXRlICAgOiAy MDI2LTA4LTI3VDA5OjU4OjA3KzAyOjAwClN0YXRzICA6ICsxMzcvLTEgaW4gMiBmaWxlKHMpClVS TCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMva2JkL2MvN2Q2N2EyMjNm MGVhMmQ3NTc0MmM5ZGRhZjIzNzExYzc1YWFmYmFiOT9icmFuY2g9ZjQ0CgpMb2c6CkZpeCBvcGVu dnQgLXUgcHJvY2VzcyBtYXRjaGluZyB0byBiZSBtb3JlIGNvbnNlcnZhdGl2ZSAoQ1ZFLTIwMjYt NzI2OTMpCgotLS0KZGlmZiAtLWdpdCBhL2tiZC0yLjkuMC1DVkUtMjAyNi03MjY5My5wYXRjaCBi L2tiZC0yLjkuMC1DVkUtMjAyNi03MjY5My5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwLi43NmNiYWNkCi0tLSAvZGV2L251bGwKKysrIGIva2JkLTIuOS4wLUNWRS0yMDI2 LTcyNjkzLnBhdGNoCkBAIC0wLDAgKzEsMTI5IEBACitkaWZmIC0tZ2l0IGEvZG9jcy9tYW4vbWFu MS9vcGVudnQuMSBiL2RvY3MvbWFuL21hbjEvb3BlbnZ0LjEKK2luZGV4IDhmMTI0NGYxLi40MDRl NGEwNiAxMDA2NDQKKy0tLSBhL2RvY3MvbWFuL21hbjEvb3BlbnZ0LjEKKysrKyBiL2RvY3MvbWFu L21hbjEvb3BlbnZ0LjEKK0BAIC0zNiw2ICszNiw4IEBAIHdpbGwgYmUgbWFkZSB0aGUgbmV3IGN1 cnJlbnQgVlQuCisgXGZCXC11XGZSLCBcZkJcLVwtdXNlclxmUgorIEZpZ3VyZSBvdXQgdGhlIG93 bmVyIG9mIHRoZSBjdXJyZW50IFZULCBhbmQgcnVuIGxvZ2luIGFzIHRoYXQgdXNlci4KKyBTdWl0 YWJsZSB0byBiZSBjYWxsZWQgYnkgaW5pdC4gU2hvdWxkbid0IGJlIHVzZWQgd2l0aCBcZklcLWNc ZlIgb3IgXGZJXC1sXGZSLgorK1RoaXMgb3B0aW9uIHJlZnVzZXMgdG8gcHJlLWF1dGhlbnRpY2F0 ZSByb290IGFuZCByZXF1aXJlcyBhIHByb2Nlc3Mgb3duZWQgYnkKKyt0aGUgVlQgb3duZXIgd2hv c2UgY29udHJvbGxpbmcgdGVybWluYWwgaXMgdGhlIGN1cnJlbnQgVlQuCisgLlRQCisgXGZCXC1s XGZSLCBcZkJcLVwtbG9naW5cZlIKKyBNYWtlIHRoZSBjb21tYW5kIGEgbG9naW4gc2hlbGwuIEEg XC0gaXMgcHJlcGVuZGVkIHRvIHRoZSBuYW1lIG9mIHRoZSBjb21tYW5kCitAQCAtNjQsNiArNjYs MTQgQEAgSWYKKyBpcyBjb21waWxlZCB3aXRoIGEgZ2V0b3B0X2xvbmcoKSBhbmQgeW91IHdpc2gg dG8gc2V0Cisgb3B0aW9ucyB0byB0aGUgY29tbWFuZCB0byBiZSBydW4sIHRoZW4geW91IG11c3Qg c3VwcGx5CisgdGhlIGVuZCBvZiBvcHRpb25zIFwtXC0gZmxhZyBiZWZvcmUgdGhlIGNvbW1hbmQu CisrLlBQCisrVGhlCisrLkIgXC11Cisrb3B0aW9uIHVzZXMKKysuQlIgImxvZ2luIC1mIgorK2Fu ZCB0aGVyZWZvcmUgYnlwYXNzZXMgbm9ybWFsIHBhc3N3b3JkIGF1dGhlbnRpY2F0aW9uIGZvciB0 aGUgZGV0ZWN0ZWQgdXNlci4KKytJdCBpcyBpbnRlbmRlZCBvbmx5IGZvciBjb250cm9sbGVkIGlu aXQgb3Iga2V5Ym9hcmQtcmVxdWVzdCBjb25maWd1cmF0aW9ucy4KKytVc2UgYSBub3JtYWwgYXV0 aGVudGljYXRlZCBsb2dpbiBjb21tYW5kIHdoZW4gYXV0aGVudGljYXRpb24gaXMgcmVxdWlyZWQu CisgLlNIIEVYQU1QTEVTCisgLkIgb3BlbnZ0CisgY2FuIGJlIHVzZWQgdG8gc3RhcnQgYSBzaGVs bCBvbiB0aGUgbmV4dCBmcmVlIFZULCBieSB1c2luZyB0aGUgY29tbWFuZDoKK2RpZmYgLS1naXQg YS9zcmMvb3BlbnZ0LmMgYi9zcmMvb3BlbnZ0LmMKK2luZGV4IGVkM2VkMThlLi5kYWIzZGFkOCAx MDA2NDQKKy0tLSBhL3NyYy9vcGVudnQuYworKysrIGIvc3JjL29wZW52dC5jCitAQCAtNTcsNiAr NTcsNTEgQEAgdXNhZ2UoaW50IHJjLCBjb25zdCBzdHJ1Y3Qga2JkX2hlbHAgKm9wdGlvbnMpCisg CWV4aXQocmMpOworIH0KKworK3N0YXRpYyBpbnQKKytwcm9jX3BpZF9zdGF0KGNvbnN0IGNoYXIg KnBpZCwgdWlkX3QgKnVpZCwgZGV2X3QgKnR0eSkKKyt7CisrCWNoYXIgZmlsZW5hbWVbTkFNRV9N QVggKyAxMl07CisrCWNoYXIgbGluZVtCVUZTSVpdOworKwljaGFyICpscCwgKnJwOworKwlGSUxF ICpmcDsKKysJc3RydWN0IHN0YXQgc3Q7CisrCWxvbmcgdHR5X25yOworKworKwlzbnByaW50Zihm aWxlbmFtZSwgc2l6ZW9mKGZpbGVuYW1lKSwgIi9wcm9jLyVzL3N0YXQiLCBwaWQpOworKwlmcCA9 IGZvcGVuKGZpbGVuYW1lLCAiciIpOworKwlpZiAoIWZwKQorKwkJcmV0dXJuIC0xOworKworKwlp ZiAoZnN0YXQoZmlsZW5vKGZwKSwgJnN0KSkgeworKwkJZmNsb3NlKGZwKTsKKysJCXJldHVybiAt MTsKKysJfQorKworKwlpZiAoIWZnZXRzKGxpbmUsIHNpemVvZihsaW5lKSwgZnApKSB7CisrCQlm Y2xvc2UoZnApOworKwkJcmV0dXJuIC0xOworKwl9CisrCWZjbG9zZShmcCk7CisrCisrCXJwID0g c3RycmNocihsaW5lLCAnKScpOworKwlpZiAoIXJwKQorKwkJcmV0dXJuIC0xOworKworKwkvKgor KwkgKiAvcHJvYy88cGlkPi9zdGF0IGZpZWxkcyBhZnRlciBjb21tIGFyZToKKysJICogc3RhdGUg cHBpZCBwZ3JwIHNlc3Npb24gdHR5X25yIC4uLgorKwkgKi8KKysJaWYgKCFycCB8fCBzc2NhbmYo cnAgKyAxLCAiICUqYyAlKmQgJSpkICUqZCAlbGQiLCAmdHR5X25yKSAhPSAxKQorKwkJcmV0dXJu IC0xOworKworKwlpZiAodHR5X25yIDw9IDApCisrCQlyZXR1cm4gLTE7CisrCisrCSp1aWQgPSBz dC5zdF91aWQ7CisrCSp0dHkgPSAoZGV2X3QpIHR0eV9ucjsKKysJcmV0dXJuIDA7CisrfQorKwor IC8qCisgICogU3VwcG9ydCBmb3IgU3Bhd25fQ29uc29sZTogb3BlbnZ0IHJ1bm5pbmcgZnJvbSBp bml0CisgICogYWRkZWQgYnkgSm9zaHVhIFNwb2VycmksIFRodSBKdWwgMTggMjE6MTM6MTYgRURU IDE5OTYKK0BAIC04OCw4ICsxMzMsNyBAQCBhdXRoZW50aWNhdGVfdXNlcihpbnQgY3VydnQpCisg CURJUiAqZHA7CisgCXN0cnVjdCBkaXJlbnQgKmRlbnRwOworIAlzdHJ1Y3Qgc3RhdCBidWY7Cist CWRldl90IGNvbnNvbGVfZGV2OworLQlpbm9fdCBjb25zb2xlX2lubzsKKysJZGV2X3QgY29uc29s ZV9yZGV2OworIAl1aWRfdCBjb25zb2xlX3VpZDsKKyAJY2hhciBmaWxlbmFtZVtOQU1FX01BWCAr IDEyXTsKKyAJc3RydWN0IHBhc3N3ZCAqcHduYW07CitAQCAtMTA5LDEwICsxNTMsMTIgQEAgYXV0 aGVudGljYXRlX3VzZXIoaW50IGN1cnZ0KQorIAkJCWtiZF9lcnJvcihFWElUX0ZBSUxVUkUsIGVy cnN2LCAiJXMiLCBmaWxlbmFtZSk7CisgCQl9CisgCX0KKy0JY29uc29sZV9kZXYgPSBidWYuc3Rf ZGV2OworLQljb25zb2xlX2lubyA9IGJ1Zi5zdF9pbm87CisrCWNvbnNvbGVfcmRldiA9IGJ1Zi5z dF9yZGV2OworIAljb25zb2xlX3VpZCA9IGJ1Zi5zdF91aWQ7CisKKysJaWYgKGNvbnNvbGVfdWlk ID09IDApCisrCQlrYmRfZXJyb3IoRVhJVF9GQUlMVVJFLCAwLCBfKCJSZWZ1c2luZyB0byBwcmUt YXV0aGVudGljYXRlIHJvb3Qgb24gY3VycmVudCB0dHkuIikpOworKworIAkvKiBnZXQgdGhlIG93 bmVyIG9mIGN1cnJlbnQgdHR5ICovCisgCWlmICghKHB3bmFtID0gZ2V0cHd1aWQoY29uc29sZV91 aWQpKSkKKyAJCWtiZF9lcnJvcihFWElUX0ZBSUxVUkUsIGVycm5vLCAiZ2V0cHd1aWQiKTsKK0BA IC0xMjAsMTIgKzE2NiwxNiBAQCBhdXRoZW50aWNhdGVfdXNlcihpbnQgY3VydnQpCisgCS8qIGNo ZWNrIHRvIG1ha2Ugc3VyZSB0aGF0IHVzZXIgaGFzIGEgcHJvY2VzcyBvbiB0aGF0IHR0eSAqLwor IAkvKiB0aGlzIHdpbGwgZmFpbCBmb3IgZXhhbXBsZSB3aGVuIFggaXMgcnVubmluZyBvbiB0aGUg dHR5ICovCisgCXdoaWxlICgoZGVudHAgPSByZWFkZGlyKGRwKSkpIHsKKy0JCXNwcmludGYoZmls ZW5hbWUsICIvcHJvYy8lcy9mZC8wIiwgZGVudHAtPmRfbmFtZSk7CisrCQl1aWRfdCBwcm9jX3Vp ZDsKKysJCWRldl90IHByb2NfdHR5OworKworKwkJaWYgKGRlbnRwLT5kX25hbWVbMF0gPCAnMCcg fHwgZGVudHAtPmRfbmFtZVswXSA+ICc5JykKKysJCQljb250aW51ZTsKKworLQkJaWYgKHN0YXQo ZmlsZW5hbWUsICZidWYpKQorKwkJaWYgKHByb2NfcGlkX3N0YXQoZGVudHAtPmRfbmFtZSwgJnBy b2NfdWlkLCAmcHJvY190dHkpIDwgMCkKKyAJCQljb250aW51ZTsKKworLQkJaWYgKGJ1Zi5zdF9k ZXYgPT0gY29uc29sZV9kZXYgJiYgYnVmLnN0X2lubyA9PSBjb25zb2xlX2lubyAmJiBidWYuc3Rf dWlkID09IGNvbnNvbGVfdWlkKQorKwkJaWYgKHByb2NfdWlkID09IGNvbnNvbGVfdWlkICYmIHBy b2NfdHR5ID09IGNvbnNvbGVfcmRldikKKyAJCQlnb3RvIGdvdF9hX3Byb2Nlc3M7CisgCX0KKwoK ZGlmZiAtLWdpdCBhL2tiZC5zcGVjIGIva2JkLnNwZWMKaW5kZXggYjA5NjMyYy4uZTYyOGQ0OSAx MDA2NDQKLS0tIGEva2JkLnNwZWMKKysrIGIva2JkLnNwZWMKQEAgLTUsNyArNSw3IEBACiAKIE5h bWU6ICAgICAgICAgICBrYmQKIFZlcnNpb246ICAgICAgICAyLjkuMAotUmVsZWFzZTogICAgICAg IDMlez9kaXN0fQorUmVsZWFzZTogICAgICAgIDQlez9kaXN0fQogU3VtbWFyeTogICAgICAgIFRv b2xzIGZvciBjb25maWd1cmluZyB0aGUgY29uc29sZSAoa2V5Ym9hcmQsIHZpcnR1YWwgdGVybWlu YWxzLCBldGMuKQogTGljZW5zZTogICAgICAgIEdQTC0yLjAtb3ItbGF0ZXIKIFVSTDogICAgICAg ICAgICBodHRwOi8vd3d3LmtiZC1wcm9qZWN0Lm9yZy8KQEAgLTM3LDYgKzM3LDkgQEAgUGF0Y2g3 OiAgICAgICAgIGtiZC0yLjAuNC12bG9jay1hZGQtcHJvbXB0LW9wdGlvbi5wYXRjaAogIyBQYXRj aDg6IGZpeGVzIHNldGZvbnQgc2VnZmF1bHQgd2hlbiBvcHRpb24gdGhhdCBuZWVkcyBhbiBhcmd1 bWVudCBpcyBwYXNzZWQKICMgICB3aXRoIHRoZSBhcmd1bWVudCBibGFuaywgYnogMjQ0Nzg5MiAo YWxyZWFkeSB1cHN0cmVhbSkKIFBhdGNoODogICAgICAgICBrYmQtMi45LjAtZml4LXNldGZvbnQt c2VnZmF1bHQucGF0Y2gKKyMgUGF0Y2g5OiBmaXhlcyBDVkUtMjAyNi03MjY5MywgYmFja3BvcnRl ZCBmcm9tIHVwc3RyZWFtCisjIGh0dHBzOi8vZ2l0aHViLmNvbS9sZWdpb251cy9rYmQvY29tbWl0 Lzc4ZDVhZTExOTc0MmU4N2JhYTdkYmUwZjVjNDEwN2U3NTMzZmQ2OTgKK1BhdGNoOTogICAgICAg ICBrYmQtMi45LjAtQ1ZFLTIwMjYtNzI2OTMucGF0Y2gKIAogQnVpbGRSZXF1aXJlczogIGdjYywg Ymlzb24sIGZsZXgsIGdldHRleHQsIHBhbS1kZXZlbCwgY2hlY2stZGV2ZWwsIGF1dG9tYWtlCiBC dWlsZFJlcXVpcmVzOiAgY29uc29sZS1zZXR1cCwgeGtleWJvYXJkLWNvbmZpZwpAQCAtMTg3LDYg KzE5MCwxMCBAQCBmaQogJXtrYmRfZGF0YWRpcn0va2V5bWFwcy9sZWdhY3kKIAogJWNoYW5nZWxv ZworKiBUaHUgQXVnIDI3IDIwMjYgVml0ZXpzbGF2IENyaG9uZWsgPHZjcmhvbmVrQHJlZGhhdC5j b20+IC0gMi45LjAtNAorLSBGaXggb3BlbnZ0IC11IHByb2Nlc3MgbWF0Y2hpbmcgdG8gYmUgbW9y ZSBjb25zZXJ2YXRpdmUgKENWRS0yMDI2LTcyNjkzKQorICBSZXNvbHZlczogIzI1MTM3OTUKKwog KiBUdWUgTWFyIDI0IDIwMjYgVml0ZXpzbGF2IENyaG9uZWsgPHZjcmhvbmVrQHJlZGhhdC5jb20+ IC0gMi45LjAtMwogLSBGaXggc2V0Zm9udCBzZWdtZW50YXRpb24gZmF1bHQgd2hlbiBhcmd1bWVu dCBmb3Igb3B0aW9uIGlzIG1pc3NpbmcKICAgUmVzb2x2ZXM6ICMyNDQ3ODkyCg==