Backport of: From bc6b36682f188020ee4770fae1d41bde5b2c97bb Mon Sep 17 00:00:00 2001 From: "Andrew G. Morgan" Date: Wed, 3 May 2023 19:18:36 -0700 Subject: Correct the check of pthread_create()'s return value. This function returns a positive number (errno) on error, so the code wasn't previously freeing some memory in this situation. Discussion: https://stackoverflow.com/a/3581020/14760867 Credit for finding this bug in libpsx goes to David Gstir of X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit of the libcap source code in April of 2023. The audit was sponsored by the Open Source Technology Improvement Fund (https://ostif.org/). Audit ref: LCAP-CR-23-01 (CVE-2023-2602) Signed-off-by: Andrew G. Morgan Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libcap2/tree/debian/patches/CVE-2023-2602.patch?h=ubuntu/focal-security Upstream commit https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb] CVE: CVE-2023-2602 Signed-off-by: Vijay Anusuri --- psx/psx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/libcap/psx.c +++ b/libcap/psx.c @@ -272,7 +272,7 @@ int psx_pthread_create(pthread_t *thread psx_wait_for_idle(); int ret = pthread_create(thread, attr, start_routine, arg); - if (ret != -1) { + if (ret == 0) { psx_do_registration(*thread); } psx_resume_idle(); @@ -287,7 +287,7 @@ int __wrap_pthread_create(pthread_t *thr void *(*start_routine) (void *), void *arg) { psx_wait_for_idle(); int ret = __real_pthread_create(thread, attr, start_routine, arg); - if (ret != -1) { + if (ret == 0) { psx_do_registration(*thread); } psx_resume_idle();