[PATCH 2/2] Security BUG: POSTFAILURE runs on not verified scripts

[Stefano Babic]

In case a script is not correctly extracted, because it is manipulated
and the hash does not match or it is encrypted and cannot be encrypted,
SWUpdate will run the POSTFAILURE scripts. However, even the script that
was not successfully extracted and verified is probed for the
postfailure function. An attacker could inject a amnipulated script,
that will be detected by SWUpdate, but then not verified code can be
executed.

The patch simply drops the (partially) extracted file to be sure that
cannot be executed.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---
core/installer.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/core/installer.c b/core/installer.c
index c31b0f11..f27191b8 100644
--- a/core/installer.c
+++ b/core/installer.c
@@ -161,11 +161,18 @@ static int extract_scripts(struct imglist *head)
.cipher = script->cipher,
};
ret = copyfile(&copy);
+
close(fdin);
close(fdout);

- if (ret < 0)
+ /*
+ * if the script was not successful extracted,
+ * drop it to avoid to be called as POSTFAILURE
+ */
+ if (ret < 0) {
+ unlink(script->extract_file);
return ret;
+ }
}
return 0;
}
--
2.43.0