From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Vitezslav Crhonek To: git-commits@fedoraproject.org Subject: [rpms/kbd] f43: Fix openvt -u process matching to be more conservative (CVE-2026-72693) Date: Thu, 27 Aug 2026 08:17:48 GMT Message-ID: <178781866824.1.16108386932614619700.rpms-kbd-628c7113c88c@fedoraproject.org> List-ID: X-Git-Repo: rpms/kbd X-Git-Branch: f43 X-Git-Rev: 628c7113c88c3d5a63c489aaebc6e07e43cfda0a QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMva2JkCkJyYW5jaCA6 IGY0MwpDb21taXQgOiA2MjhjNzExM2M4OGMzZDVhNjNjNDg5YWFlYmM2ZTA3ZTQzY2ZkYTBhCkF1 dGhvciA6IFZpdGV6c2xhdiBDcmhvbmVrIDx2Y3Job25la0ByZWRoYXQuY29tPgpEYXRlICAgOiAy MDI2LTA4LTI3VDEwOjE3OjMxKzAyOjAwClN0YXRzICA6ICsxMzcvLTEgaW4gMiBmaWxlKHMpClVS TCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMva2JkL2MvNjI4YzcxMTNj ODhjM2Q1YTYzYzQ4OWFhZWJjNmUwN2U0M2NmZGEwYT9icmFuY2g9ZjQzCgpMb2c6CkZpeCBvcGVu dnQgLXUgcHJvY2VzcyBtYXRjaGluZyB0byBiZSBtb3JlIGNvbnNlcnZhdGl2ZSAoQ1ZFLTIwMjYt NzI2OTMpCgotLS0KZGlmZiAtLWdpdCBhL2tiZC0yLjkuMC1DVkUtMjAyNi03MjY5My5wYXRjaCBi L2tiZC0yLjkuMC1DVkUtMjAyNi03MjY5My5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwLi43NmNiYWNkCi0tLSAvZGV2L251bGwKKysrIGIva2JkLTIuOS4wLUNWRS0yMDI2 LTcyNjkzLnBhdGNoCkBAIC0wLDAgKzEsMTI5IEBACitkaWZmIC0tZ2l0IGEvZG9jcy9tYW4vbWFu MS9vcGVudnQuMSBiL2RvY3MvbWFuL21hbjEvb3BlbnZ0LjEKK2luZGV4IDhmMTI0NGYxLi40MDRl NGEwNiAxMDA2NDQKKy0tLSBhL2RvY3MvbWFuL21hbjEvb3BlbnZ0LjEKKysrKyBiL2RvY3MvbWFu L21hbjEvb3BlbnZ0LjEKK0BAIC0zNiw2ICszNiw4IEBAIHdpbGwgYmUgbWFkZSB0aGUgbmV3IGN1 cnJlbnQgVlQuCisgXGZCXC11XGZSLCBcZkJcLVwtdXNlclxmUgorIEZpZ3VyZSBvdXQgdGhlIG93 bmVyIG9mIHRoZSBjdXJyZW50IFZULCBhbmQgcnVuIGxvZ2luIGFzIHRoYXQgdXNlci4KKyBTdWl0 YWJsZSB0byBiZSBjYWxsZWQgYnkgaW5pdC4gU2hvdWxkbid0IGJlIHVzZWQgd2l0aCBcZklcLWNc ZlIgb3IgXGZJXC1sXGZSLgorK1RoaXMgb3B0aW9uIHJlZnVzZXMgdG8gcHJlLWF1dGhlbnRpY2F0 ZSByb290IGFuZCByZXF1aXJlcyBhIHByb2Nlc3Mgb3duZWQgYnkKKyt0aGUgVlQgb3duZXIgd2hv c2UgY29udHJvbGxpbmcgdGVybWluYWwgaXMgdGhlIGN1cnJlbnQgVlQuCisgLlRQCisgXGZCXC1s XGZSLCBcZkJcLVwtbG9naW5cZlIKKyBNYWtlIHRoZSBjb21tYW5kIGEgbG9naW4gc2hlbGwuIEEg XC0gaXMgcHJlcGVuZGVkIHRvIHRoZSBuYW1lIG9mIHRoZSBjb21tYW5kCitAQCAtNjQsNiArNjYs MTQgQEAgSWYKKyBpcyBjb21waWxlZCB3aXRoIGEgZ2V0b3B0X2xvbmcoKSBhbmQgeW91IHdpc2gg dG8gc2V0Cisgb3B0aW9ucyB0byB0aGUgY29tbWFuZCB0byBiZSBydW4sIHRoZW4geW91IG11c3Qg c3VwcGx5CisgdGhlIGVuZCBvZiBvcHRpb25zIFwtXC0gZmxhZyBiZWZvcmUgdGhlIGNvbW1hbmQu CisrLlBQCisrVGhlCisrLkIgXC11Cisrb3B0aW9uIHVzZXMKKysuQlIgImxvZ2luIC1mIgorK2Fu ZCB0aGVyZWZvcmUgYnlwYXNzZXMgbm9ybWFsIHBhc3N3b3JkIGF1dGhlbnRpY2F0aW9uIGZvciB0 aGUgZGV0ZWN0ZWQgdXNlci4KKytJdCBpcyBpbnRlbmRlZCBvbmx5IGZvciBjb250cm9sbGVkIGlu aXQgb3Iga2V5Ym9hcmQtcmVxdWVzdCBjb25maWd1cmF0aW9ucy4KKytVc2UgYSBub3JtYWwgYXV0 aGVudGljYXRlZCBsb2dpbiBjb21tYW5kIHdoZW4gYXV0aGVudGljYXRpb24gaXMgcmVxdWlyZWQu CisgLlNIIEVYQU1QTEVTCisgLkIgb3BlbnZ0CisgY2FuIGJlIHVzZWQgdG8gc3RhcnQgYSBzaGVs bCBvbiB0aGUgbmV4dCBmcmVlIFZULCBieSB1c2luZyB0aGUgY29tbWFuZDoKK2RpZmYgLS1naXQg YS9zcmMvb3BlbnZ0LmMgYi9zcmMvb3BlbnZ0LmMKK2luZGV4IGVkM2VkMThlLi5kYWIzZGFkOCAx MDA2NDQKKy0tLSBhL3NyYy9vcGVudnQuYworKysrIGIvc3JjL29wZW52dC5jCitAQCAtNTcsNiAr NTcsNTEgQEAgdXNhZ2UoaW50IHJjLCBjb25zdCBzdHJ1Y3Qga2JkX2hlbHAgKm9wdGlvbnMpCisg CWV4aXQocmMpOworIH0KKworK3N0YXRpYyBpbnQKKytwcm9jX3BpZF9zdGF0KGNvbnN0IGNoYXIg KnBpZCwgdWlkX3QgKnVpZCwgZGV2X3QgKnR0eSkKKyt7CisrCWNoYXIgZmlsZW5hbWVbTkFNRV9N QVggKyAxMl07CisrCWNoYXIgbGluZVtCVUZTSVpdOworKwljaGFyICpscCwgKnJwOworKwlGSUxF ICpmcDsKKysJc3RydWN0IHN0YXQgc3Q7CisrCWxvbmcgdHR5X25yOworKworKwlzbnByaW50Zihm aWxlbmFtZSwgc2l6ZW9mKGZpbGVuYW1lKSwgIi9wcm9jLyVzL3N0YXQiLCBwaWQpOworKwlmcCA9 IGZvcGVuKGZpbGVuYW1lLCAiciIpOworKwlpZiAoIWZwKQorKwkJcmV0dXJuIC0xOworKworKwlp ZiAoZnN0YXQoZmlsZW5vKGZwKSwgJnN0KSkgeworKwkJZmNsb3NlKGZwKTsKKysJCXJldHVybiAt MTsKKysJfQorKworKwlpZiAoIWZnZXRzKGxpbmUsIHNpemVvZihsaW5lKSwgZnApKSB7CisrCQlm Y2xvc2UoZnApOworKwkJcmV0dXJuIC0xOworKwl9CisrCWZjbG9zZShmcCk7CisrCisrCXJwID0g c3RycmNocihsaW5lLCAnKScpOworKwlpZiAoIXJwKQorKwkJcmV0dXJuIC0xOworKworKwkvKgor KwkgKiAvcHJvYy88cGlkPi9zdGF0IGZpZWxkcyBhZnRlciBjb21tIGFyZToKKysJICogc3RhdGUg cHBpZCBwZ3JwIHNlc3Npb24gdHR5X25yIC4uLgorKwkgKi8KKysJaWYgKCFycCB8fCBzc2NhbmYo cnAgKyAxLCAiICUqYyAlKmQgJSpkICUqZCAlbGQiLCAmdHR5X25yKSAhPSAxKQorKwkJcmV0dXJu IC0xOworKworKwlpZiAodHR5X25yIDw9IDApCisrCQlyZXR1cm4gLTE7CisrCisrCSp1aWQgPSBz dC5zdF91aWQ7CisrCSp0dHkgPSAoZGV2X3QpIHR0eV9ucjsKKysJcmV0dXJuIDA7CisrfQorKwor IC8qCisgICogU3VwcG9ydCBmb3IgU3Bhd25fQ29uc29sZTogb3BlbnZ0IHJ1bm5pbmcgZnJvbSBp bml0CisgICogYWRkZWQgYnkgSm9zaHVhIFNwb2VycmksIFRodSBKdWwgMTggMjE6MTM6MTYgRURU IDE5OTYKK0BAIC04OCw4ICsxMzMsNyBAQCBhdXRoZW50aWNhdGVfdXNlcihpbnQgY3VydnQpCisg CURJUiAqZHA7CisgCXN0cnVjdCBkaXJlbnQgKmRlbnRwOworIAlzdHJ1Y3Qgc3RhdCBidWY7Cist CWRldl90IGNvbnNvbGVfZGV2OworLQlpbm9fdCBjb25zb2xlX2lubzsKKysJZGV2X3QgY29uc29s ZV9yZGV2OworIAl1aWRfdCBjb25zb2xlX3VpZDsKKyAJY2hhciBmaWxlbmFtZVtOQU1FX01BWCAr IDEyXTsKKyAJc3RydWN0IHBhc3N3ZCAqcHduYW07CitAQCAtMTA5LDEwICsxNTMsMTIgQEAgYXV0 aGVudGljYXRlX3VzZXIoaW50IGN1cnZ0KQorIAkJCWtiZF9lcnJvcihFWElUX0ZBSUxVUkUsIGVy cnN2LCAiJXMiLCBmaWxlbmFtZSk7CisgCQl9CisgCX0KKy0JY29uc29sZV9kZXYgPSBidWYuc3Rf ZGV2OworLQljb25zb2xlX2lubyA9IGJ1Zi5zdF9pbm87CisrCWNvbnNvbGVfcmRldiA9IGJ1Zi5z dF9yZGV2OworIAljb25zb2xlX3VpZCA9IGJ1Zi5zdF91aWQ7CisKKysJaWYgKGNvbnNvbGVfdWlk ID09IDApCisrCQlrYmRfZXJyb3IoRVhJVF9GQUlMVVJFLCAwLCBfKCJSZWZ1c2luZyB0byBwcmUt YXV0aGVudGljYXRlIHJvb3Qgb24gY3VycmVudCB0dHkuIikpOworKworIAkvKiBnZXQgdGhlIG93 bmVyIG9mIGN1cnJlbnQgdHR5ICovCisgCWlmICghKHB3bmFtID0gZ2V0cHd1aWQoY29uc29sZV91 aWQpKSkKKyAJCWtiZF9lcnJvcihFWElUX0ZBSUxVUkUsIGVycm5vLCAiZ2V0cHd1aWQiKTsKK0BA IC0xMjAsMTIgKzE2NiwxNiBAQCBhdXRoZW50aWNhdGVfdXNlcihpbnQgY3VydnQpCisgCS8qIGNo ZWNrIHRvIG1ha2Ugc3VyZSB0aGF0IHVzZXIgaGFzIGEgcHJvY2VzcyBvbiB0aGF0IHR0eSAqLwor IAkvKiB0aGlzIHdpbGwgZmFpbCBmb3IgZXhhbXBsZSB3aGVuIFggaXMgcnVubmluZyBvbiB0aGUg dHR5ICovCisgCXdoaWxlICgoZGVudHAgPSByZWFkZGlyKGRwKSkpIHsKKy0JCXNwcmludGYoZmls ZW5hbWUsICIvcHJvYy8lcy9mZC8wIiwgZGVudHAtPmRfbmFtZSk7CisrCQl1aWRfdCBwcm9jX3Vp ZDsKKysJCWRldl90IHByb2NfdHR5OworKworKwkJaWYgKGRlbnRwLT5kX25hbWVbMF0gPCAnMCcg fHwgZGVudHAtPmRfbmFtZVswXSA+ICc5JykKKysJCQljb250aW51ZTsKKworLQkJaWYgKHN0YXQo ZmlsZW5hbWUsICZidWYpKQorKwkJaWYgKHByb2NfcGlkX3N0YXQoZGVudHAtPmRfbmFtZSwgJnBy b2NfdWlkLCAmcHJvY190dHkpIDwgMCkKKyAJCQljb250aW51ZTsKKworLQkJaWYgKGJ1Zi5zdF9k ZXYgPT0gY29uc29sZV9kZXYgJiYgYnVmLnN0X2lubyA9PSBjb25zb2xlX2lubyAmJiBidWYuc3Rf dWlkID09IGNvbnNvbGVfdWlkKQorKwkJaWYgKHByb2NfdWlkID09IGNvbnNvbGVfdWlkICYmIHBy b2NfdHR5ID09IGNvbnNvbGVfcmRldikKKyAJCQlnb3RvIGdvdF9hX3Byb2Nlc3M7CisgCX0KKwoK ZGlmZiAtLWdpdCBhL2tiZC5zcGVjIGIva2JkLnNwZWMKaW5kZXggZmUzYzBlMC4uMmRhYzNkMiAx MDA2NDQKLS0tIGEva2JkLnNwZWMKKysrIGIva2JkLnNwZWMKQEAgLTUsNyArNSw3IEBACiAKIE5h bWU6ICAgICAgICAgICBrYmQKIFZlcnNpb246ICAgICAgICAyLjguMAotUmVsZWFzZTogICAgICAg IDMlez9kaXN0fQorUmVsZWFzZTogICAgICAgIDQlez9kaXN0fQogU3VtbWFyeTogICAgICAgIFRv b2xzIGZvciBjb25maWd1cmluZyB0aGUgY29uc29sZSAoa2V5Ym9hcmQsIHZpcnR1YWwgdGVybWlu YWxzLCBldGMuKQogTGljZW5zZTogICAgICAgIEdQTC0yLjAtb3ItbGF0ZXIKIFVSTDogICAgICAg ICAgICBodHRwOi8vd3d3LmtiZC1wcm9qZWN0Lm9yZy8KQEAgLTM0LDYgKzM0LDkgQEAgUGF0Y2g1 OiAgICAgICAgIGtiZC0yLjAuMi11bmljb2RlLXN0YXJ0LWZvbnQucGF0Y2gKIFBhdGNoNjogICAg ICAgICBrYmQtMi40LjAtY292c2Nhbi1maXhlcy5wYXRjaAogIyBQYXRjaDc6IGFkZHMgdmxvY2sg b3B0aW9uIHRvIGlzc3VlIHByb21wdCBiZWZvcmUgaW52b2thdGlvbiBvZiBwYW0gc3RhY2sKIFBh dGNoNzogICAgICAgICBrYmQtMi4wLjQtdmxvY2stYWRkLXByb21wdC1vcHRpb24ucGF0Y2gKKyMg UGF0Y2g4OiBmaXhlcyBDVkUtMjAyNi03MjY5MywgYmFja3BvcnRlZCBmcm9tIHVwc3RyZWFtCisj IGh0dHBzOi8vZ2l0aHViLmNvbS9sZWdpb251cy9rYmQvY29tbWl0Lzc4ZDVhZTExOTc0MmU4N2Jh YTdkYmUwZjVjNDEwN2U3NTMzZmQ2OTgKK1BhdGNoODogICAgICAgICBrYmQtMi45LjAtQ1ZFLTIw MjYtNzI2OTMucGF0Y2gKIAogQnVpbGRSZXF1aXJlczogIGdjYywgYmlzb24sIGZsZXgsIGdldHRl eHQsIHBhbS1kZXZlbCwgY2hlY2stZGV2ZWwsIGF1dG9tYWtlCiBCdWlsZFJlcXVpcmVzOiAgY29u c29sZS1zZXR1cCwgeGtleWJvYXJkLWNvbmZpZwpAQCAtMTg0LDYgKzE4NywxMCBAQCBmaQogJXtr YmRfZGF0YWRpcn0va2V5bWFwcy9sZWdhY3kKIAogJWNoYW5nZWxvZworKiBUaHUgQXVnIDI3IDIw MjYgVml0ZXpzbGF2IENyaG9uZWsgPHZjcmhvbmVrQHJlZGhhdC5jb20+IC0gMi44LjAtNAorLSBG aXggb3BlbnZ0IC11IHByb2Nlc3MgbWF0Y2hpbmcgdG8gYmUgbW9yZSBjb25zZXJ2YXRpdmUgKENW RS0yMDI2LTcyNjkzKQorICBSZXNvbHZlczogIzI1MTM3OTUKKwogKiBUaHUgSnVsIDI0IDIwMjUg RmVkb3JhIFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9qZWN0Lm9yZz4gLSAy LjguMC0zCiAtIFJlYnVpbHQgZm9yIGh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9GZWRv cmFfNDNfTWFzc19SZWJ1aWxkCiAK