* [PATCH 0/7] Consolidated zeus pull request
@ 2019-11-10 14:54 Anuj Mittal
2019-11-10 14:54 ` [PATCH 1/7] libxslt: fix CVE-2019-18197 Anuj Mittal
` (7 more replies)
0 siblings, 8 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
a-full passing on autobuilder for the series.
Adrian Bunk (1):
python3: Upgrade 3.7.4 -> 3.7.5
Joe Slater (1):
libxslt: fix CVE-2019-18197
Ross Burton (4):
libpng: whitelist CVE-2019-17371
procps: whitelist CVE-2018-1121
libsndfile1: whitelist CVE-2018-13419
libpam: set CVE_PRODUCT
Trevor Gamblin (1):
libgcrypt: fix CVE-2019-13627
...lib-as-location-for-site-packages-an.patch | 2 +-
...nt-parse-domains-containing-GH-13079.patch | 132 ------------------
...asename-to-replace-CC-for-checking-c.patch | 2 +-
.../{python3_3.7.4.bb => python3_3.7.5.bb} | 5 +-
meta/recipes-extended/pam/libpam_1.3.1.bb | 2 +
meta/recipes-extended/procps/procps_3.3.15.bb | 9 +-
.../libpng/libpng_1.6.37.bb | 3 +
.../libsndfile/libsndfile1_1.0.28.bb | 4 +
...cdsa-Fix-use-of-nonce-use-larger-one.patch | 128 +++++++++++++++++
...Add-mitigation-against-timing-attack.patch | 70 ++++++++++
.../libgcrypt/libgcrypt_1.8.4.bb | 2 +
.../libxslt/files/CVE-2019-18197.patch | 33 +++++
.../recipes-support/libxslt/libxslt_1.1.33.bb | 1 +
13 files changed, 253 insertions(+), 140 deletions(-)
delete mode 100644 meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
rename meta/recipes-devtools/python/{python3_3.7.4.bb => python3_3.7.5.bb} (98%)
create mode 100644 meta/recipes-support/libgcrypt/files/0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch
create mode 100644 meta/recipes-support/libgcrypt/files/0001-ecc-Add-mitigation-against-timing-attack.patch
create mode 100644 meta/recipes-support/libxslt/files/CVE-2019-18197.patch
--
2.21.0
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 1/7] libxslt: fix CVE-2019-18197
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 2/7] python3: Upgrade 3.7.4 -> 3.7.5 Anuj Mittal
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Joe Slater <joe.slater@windriver.com>
Use patch from upstream after 1.1.33 release.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../libxslt/files/CVE-2019-18197.patch | 33 +++++++++++++++++++
.../recipes-support/libxslt/libxslt_1.1.33.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-support/libxslt/files/CVE-2019-18197.patch
diff --git a/meta/recipes-support/libxslt/files/CVE-2019-18197.patch b/meta/recipes-support/libxslt/files/CVE-2019-18197.patch
new file mode 100644
index 0000000000..5f2b620396
--- /dev/null
+++ b/meta/recipes-support/libxslt/files/CVE-2019-18197.patch
@@ -0,0 +1,33 @@
+libxslt: fix CVE-2019-18197
+
+Added after 1.1.33 release.
+
+CVE: CVE-2019-18197
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt.git]
+Signed-off-by: Joe Slater <joe.slater@windriver.com>
+
+commit 2232473733b7313d67de8836ea3b29eec6e8e285
+Author: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat Aug 17 16:51:53 2019 +0200
+
+ Fix dangling pointer in xsltCopyText
+
+ xsltCopyText didn't reset ctxt->lasttext in some cases which could
+ lead to various memory errors in relation with CDATA sections in input
+ documents.
+
+ Found by OSS-Fuzz.
+
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 95ebd07..d7ab0b6 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -1094,6 +1094,8 @@ xsltCopyText(xsltTransformContextPtr ctxt, xmlNodePtr target,
+ if ((copy->content = xmlStrdup(cur->content)) == NULL)
+ return NULL;
+ }
++
++ ctxt->lasttext = NULL;
+ } else {
+ /*
+ * normal processing. keep counters to extend the text node
diff --git a/meta/recipes-support/libxslt/libxslt_1.1.33.bb b/meta/recipes-support/libxslt/libxslt_1.1.33.bb
index abc00a09ea..9f268e7bb0 100644
--- a/meta/recipes-support/libxslt/libxslt_1.1.33.bb
+++ b/meta/recipes-support/libxslt/libxslt_1.1.33.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz \
file://0001-Fix-security-framework-bypass.patch \
file://CVE-2019-13117.patch \
file://CVE-2019-13118.patch \
+ file://CVE-2019-18197.patch \
"
SRC_URI[md5sum] = "b3bd254a03e46d58f8ad1e4559cd2c2f"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 2/7] python3: Upgrade 3.7.4 -> 3.7.5
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
2019-11-10 14:54 ` [PATCH 1/7] libxslt: fix CVE-2019-18197 Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 3/7] libpng: whitelist CVE-2019-17371 Anuj Mittal
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Adrian Bunk <bunk@stusta.de>
Backported patch removed.
3.7.5 also includes the fix for CVE-2019-16935.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
...lib-as-location-for-site-packages-an.patch | 2 +-
...nt-parse-domains-containing-GH-13079.patch | 132 ------------------
...asename-to-replace-CC-for-checking-c.patch | 2 +-
.../{python3_3.7.4.bb => python3_3.7.5.bb} | 5 +-
4 files changed, 4 insertions(+), 137 deletions(-)
delete mode 100644 meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
rename meta/recipes-devtools/python/{python3_3.7.4.bb => python3_3.7.5.bb} (98%)
diff --git a/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch b/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch
index 661f52d01f..ea75262c4f 100644
--- a/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch
+++ b/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch
@@ -70,7 +70,7 @@ index 6e81b2f..671a20e 100644
Programs/python.o: $(srcdir)/Programs/python.c
@@ -856,7 +857,7 @@ regen-opcode:
- Python/compile.o Python/symtable.o Python/ast_unparse.o Python/ast.o: $(srcdir)/Include/graminit.h $(srcdir)/Include/Python-ast.h
+ Python/compile.o Python/symtable.o Python/ast_unparse.o Python/ast.o Python/future.o Parser/parsetok.o: $(srcdir)/Include/graminit.h $(srcdir)/Include/Python-ast.h
Python/getplatform.o: $(srcdir)/Python/getplatform.c
- $(CC) -c $(PY_CORE_CFLAGS) -DPLATFORM='"$(MACHDEP)"' -o $@ $(srcdir)/Python/getplatform.c
diff --git a/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch b/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
deleted file mode 100644
index 319e7ed07e..0000000000
--- a/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From 90d56127ae15b1e452755e62c77dc475dedf7161 Mon Sep 17 00:00:00 2001
-From: jpic <jpic@users.noreply.github.com>
-Date: Wed, 17 Jul 2019 23:54:25 +0200
-Subject: [PATCH] bpo-34155: Dont parse domains containing @ (GH-13079)
-
-Before:
-
- >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
- (Address(display_name='', username='a', domain='malicious.org'),)
-
- >>> parseaddr('a@malicious.org@important.com')
- ('', 'a@malicious.org')
-
- After:
-
- >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
- (Address(display_name='', username='', domain=''),)
-
- >>> parseaddr('a@malicious.org@important.com')
- ('', 'a@')
-
-https://bugs.python.org/issue34155
-
-Upstream-Status: Backport [https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9]
-
-CVE: CVE-2019-16056
-
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
----
- Lib/email/_header_value_parser.py | 2 ++
- Lib/email/_parseaddr.py | 11 ++++++++++-
- Lib/test/test_email/test__header_value_parser.py | 10 ++++++++++
- Lib/test/test_email/test_email.py | 14 ++++++++++++++
- .../2019-05-04-13-33-37.bpo-34155.MJll68.rst | 1 +
- 5 files changed, 37 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
-
-diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py
-index fc00b4a098..bbc026ec71 100644
---- a/Lib/email/_header_value_parser.py
-+++ b/Lib/email/_header_value_parser.py
-@@ -1582,6 +1582,8 @@ def get_domain(value):
- token, value = get_dot_atom(value)
- except errors.HeaderParseError:
- token, value = get_atom(value)
-+ if value and value[0] == '@':
-+ raise errors.HeaderParseError('Invalid Domain')
- if leader is not None:
- token[:0] = [leader]
- domain.append(token)
-diff --git a/Lib/email/_parseaddr.py b/Lib/email/_parseaddr.py
-index cdfa3729ad..41ff6f8c00 100644
---- a/Lib/email/_parseaddr.py
-+++ b/Lib/email/_parseaddr.py
-@@ -379,7 +379,12 @@ class AddrlistClass:
- aslist.append('@')
- self.pos += 1
- self.gotonext()
-- return EMPTYSTRING.join(aslist) + self.getdomain()
-+ domain = self.getdomain()
-+ if not domain:
-+ # Invalid domain, return an empty address instead of returning a
-+ # local part to denote failed parsing.
-+ return EMPTYSTRING
-+ return EMPTYSTRING.join(aslist) + domain
-
- def getdomain(self):
- """Get the complete domain name from an address."""
-@@ -394,6 +399,10 @@ class AddrlistClass:
- elif self.field[self.pos] == '.':
- self.pos += 1
- sdlist.append('.')
-+ elif self.field[self.pos] == '@':
-+ # bpo-34155: Don't parse domains with two `@` like
-+ # `a@malicious.org@important.com`.
-+ return EMPTYSTRING
- elif self.field[self.pos] in self.atomends:
- break
- else:
-diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py
-index 693487bc96..7dc4de1b7b 100644
---- a/Lib/test/test_email/test__header_value_parser.py
-+++ b/Lib/test/test_email/test__header_value_parser.py
-@@ -1438,6 +1438,16 @@ class TestParser(TestParserMixin, TestEmailBase):
- self.assertEqual(addr_spec.domain, 'example.com')
- self.assertEqual(addr_spec.addr_spec, 'star.a.star@example.com')
-
-+ def test_get_addr_spec_multiple_domains(self):
-+ with self.assertRaises(errors.HeaderParseError):
-+ parser.get_addr_spec('star@a.star@example.com')
-+
-+ with self.assertRaises(errors.HeaderParseError):
-+ parser.get_addr_spec('star@a@example.com')
-+
-+ with self.assertRaises(errors.HeaderParseError):
-+ parser.get_addr_spec('star@172.17.0.1@example.com')
-+
- # get_obs_route
-
- def test_get_obs_route_simple(self):
-diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index c29cc56203..aa775881c5 100644
---- a/Lib/test/test_email/test_email.py
-+++ b/Lib/test/test_email/test_email.py
-@@ -3041,6 +3041,20 @@ class TestMiscellaneous(TestEmailBase):
- self.assertEqual(utils.parseaddr('<>'), ('', ''))
- self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '')
-
-+ def test_parseaddr_multiple_domains(self):
-+ self.assertEqual(
-+ utils.parseaddr('a@b@c'),
-+ ('', '')
-+ )
-+ self.assertEqual(
-+ utils.parseaddr('a@b.c@c'),
-+ ('', '')
-+ )
-+ self.assertEqual(
-+ utils.parseaddr('a@172.17.0.1@c'),
-+ ('', '')
-+ )
-+
- def test_noquote_dump(self):
- self.assertEqual(
- utils.formataddr(('A Silly Person', 'person@dom.ain')),
-diff --git a/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
-new file mode 100644
-index 0000000000..50292e29ed
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
-@@ -0,0 +1 @@
-+Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@c.com.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic.
diff --git a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
index 5735954628..a0ea897f4e 100644
--- a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
+++ b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
@@ -63,7 +63,7 @@ index a7de901..4a3681f 100644
+ case $cc_basename in
*clang*)
AC_SUBST(LLVM_AR)
- AC_PATH_TARGET_TOOL(LLVM_AR, llvm-ar, '', ${llvm_path})
+ AC_PATH_TOOL(LLVM_AR, llvm-ar, '', ${llvm_path})
@@ -1426,7 +1427,7 @@ then
fi
fi
diff --git a/meta/recipes-devtools/python/python3_3.7.4.bb b/meta/recipes-devtools/python/python3_3.7.5.bb
similarity index 98%
rename from meta/recipes-devtools/python/python3_3.7.4.bb
rename to meta/recipes-devtools/python/python3_3.7.5.bb
index 42818bfff2..137b540dba 100644
--- a/meta/recipes-devtools/python/python3_3.7.4.bb
+++ b/meta/recipes-devtools/python/python3_3.7.5.bb
@@ -28,7 +28,6 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://reformat_sysconfig.py \
file://0001-Use-FLAG_REF-always-for-interned-strings.patch \
file://0001-test_locale.py-correct-the-test-output-format.patch \
- file://0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch \
"
SRC_URI_append_class-native = " \
@@ -39,8 +38,8 @@ SRC_URI_append_class-nativesdk = " \
file://0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch \
"
-SRC_URI[md5sum] = "d33e4aae66097051c2eca45ee3604803"
-SRC_URI[sha256sum] = "fb799134b868199930b75f26678f18932214042639cd52b16da7fd134cd9b13f"
+SRC_URI[md5sum] = "08ed8030b1183107c48f2092e79a87e2"
+SRC_URI[sha256sum] = "e85a76ea9f3d6c485ec1780fca4e500725a4a7bbc63c78ebc44170de9b619d94"
# exclude pre-releases for both python 2.x and 3.x
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 3/7] libpng: whitelist CVE-2019-17371
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
2019-11-10 14:54 ` [PATCH 1/7] libxslt: fix CVE-2019-18197 Anuj Mittal
2019-11-10 14:54 ` [PATCH 2/7] python3: Upgrade 3.7.4 -> 3.7.5 Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 4/7] procps: whitelist CVE-2018-1121 Anuj Mittal
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@intel.com>
This is actually a memory leak in gif2png 2.x, so whitelist it in the libpng
recipe.
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-multimedia/libpng/libpng_1.6.37.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.37.bb b/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
index 66af2f3d60..2ed87a8437 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
@@ -29,3 +29,6 @@ PACKAGES =+ "${PN}-tools"
FILES_${PN}-tools = "${bindir}/png-fix-itxt ${bindir}/pngfix ${bindir}/pngcp"
BBCLASSEXTEND = "native nativesdk"
+
+# CVE-2019-17371 is actually a memory leak in gif2png 2.x
+CVE_CHECK_WHITELIST += "CVE-2019-17371"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 4/7] procps: whitelist CVE-2018-1121
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
` (2 preceding siblings ...)
2019-11-10 14:54 ` [PATCH 3/7] libpng: whitelist CVE-2019-17371 Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 5/7] libsndfile1: whitelist CVE-2018-13419 Anuj Mittal
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@intel.com>
This CVE is about race conditions in 'ps' which make it unsuitable for security
audits. As these race conditions are unavoidable ps shouldn't be used for
security auditing, so this isn't a valid CVE.
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-extended/procps/procps_3.3.15.bb | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-extended/procps/procps_3.3.15.bb b/meta/recipes-extended/procps/procps_3.3.15.bb
index 9756db0e7b..f240e54fd8 100644
--- a/meta/recipes-extended/procps/procps_3.3.15.bb
+++ b/meta/recipes-extended/procps/procps_3.3.15.bb
@@ -4,9 +4,9 @@ the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill
HOMEPAGE = "https://gitlab.com/procps-ng/procps"
SECTION = "base"
LICENSE = "GPLv2+ & LGPLv2+"
-LIC_FILES_CHKSUM="file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
- file://COPYING.LIB;md5=4cf66a4984120007c9881cc871cf49db \
- "
+LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
+ file://COPYING.LIB;md5=4cf66a4984120007c9881cc871cf49db \
+ "
DEPENDS = "ncurses"
@@ -64,3 +64,6 @@ python __anonymous() {
d.setVarFlag('ALTERNATIVE_LINK_NAME', prog, '%s/%s' % (d.getVar('base_sbindir'), prog))
}
+# 'ps' isn't suitable for use as a security tool so whitelist this CVE.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1575473#c3
+CVE_CHECK_WHITELIST += "CVE-2018-1121"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 5/7] libsndfile1: whitelist CVE-2018-13419
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
` (3 preceding siblings ...)
2019-11-10 14:54 ` [PATCH 4/7] procps: whitelist CVE-2018-1121 Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 6/7] libpam: set CVE_PRODUCT Anuj Mittal
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@intel.com>
This is a memory leak that nobody else can replicate and has been rejected by
upstream.
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb
index ffb45855a4..7855008f3d 100644
--- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb
@@ -33,3 +33,7 @@ PACKAGECONFIG[alsa] = "--enable-alsa,--disable-alsa,alsa-lib"
PACKAGECONFIG[regtest] = "--enable-sqlite,--disable-sqlite,sqlite3"
inherit autotools lib_package pkgconfig
+
+# This can't be replicated and is just a memory leak.
+# https://github.com/erikd/libsndfile/issues/398
+CVE_CHECK_WHITELIST += "CVE-2018-13419"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 6/7] libpam: set CVE_PRODUCT
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
` (4 preceding siblings ...)
2019-11-10 14:54 ` [PATCH 5/7] libsndfile1: whitelist CVE-2018-13419 Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 14:54 ` [PATCH 7/7] libgcrypt: fix CVE-2019-13627 Anuj Mittal
2019-11-10 15:02 ` ✗ patchtest: failure for Consolidated zeus pull request Patchwork
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-extended/pam/libpam_1.3.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-extended/pam/libpam_1.3.1.bb b/meta/recipes-extended/pam/libpam_1.3.1.bb
index 6b73f0a2fe..a2aa1ecd16 100644
--- a/meta/recipes-extended/pam/libpam_1.3.1.bb
+++ b/meta/recipes-extended/pam/libpam_1.3.1.bb
@@ -163,3 +163,5 @@ CONFFILES_${PN}-runtime += "${sysconfdir}/pam.d/common-account"
CONFFILES_${PN}-runtime += "${sysconfdir}/security/limits.conf"
UPSTREAM_CHECK_URI = "https://github.com/linux-pam/linux-pam/releases"
+
+CVE_PRODUCT = "linux-pam"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 7/7] libgcrypt: fix CVE-2019-13627
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
` (5 preceding siblings ...)
2019-11-10 14:54 ` [PATCH 6/7] libpam: set CVE_PRODUCT Anuj Mittal
@ 2019-11-10 14:54 ` Anuj Mittal
2019-11-10 15:02 ` ✗ patchtest: failure for Consolidated zeus pull request Patchwork
7 siblings, 0 replies; 9+ messages in thread
From: Anuj Mittal @ 2019-11-10 14:54 UTC (permalink / raw)
To: openembedded-core
From: Trevor Gamblin <trevor.gamblin@windriver.com>
Backport two fixes for CVE-2019-13627 from upstream
to zeus.
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
...cdsa-Fix-use-of-nonce-use-larger-one.patch | 128 ++++++++++++++++++
...Add-mitigation-against-timing-attack.patch | 70 ++++++++++
.../libgcrypt/libgcrypt_1.8.4.bb | 2 +
3 files changed, 200 insertions(+)
create mode 100644 meta/recipes-support/libgcrypt/files/0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch
create mode 100644 meta/recipes-support/libgcrypt/files/0001-ecc-Add-mitigation-against-timing-attack.patch
diff --git a/meta/recipes-support/libgcrypt/files/0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch b/meta/recipes-support/libgcrypt/files/0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch
new file mode 100644
index 0000000000..211e041303
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch
@@ -0,0 +1,128 @@
+From db4e9976cc31b314aafad6626b2894e86ee44d60 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 8 Aug 2019 17:42:02 +0900
+Subject: [PATCH] dsa,ecdsa: Fix use of nonce, use larger one.
+
+Upstream-Status: Backport [https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=db4e9976cc3]
+CVE: CVE-2019-13627
+Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
+
+* cipher/dsa-common.c (_gcry_dsa_modify_k): New.
+* cipher/pubkey-internal.h (_gcry_dsa_modify_k): New.
+* cipher/dsa.c (sign): Use _gcry_dsa_modify_k.
+* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Likewise.
+* cipher/ecc-gost.c (_gcry_ecc_gost_sign): Likewise.
+
+--
+
+Cherry-picked master commit of:
+ 7c2943309d14407b51c8166c4dcecb56a3628567
+
+CVE-id: CVE-2019-13627
+GnuPG-bug-id: 4626
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/dsa-common.c | 24 ++++++++++++++++++++++++
+ cipher/dsa.c | 2 ++
+ cipher/ecc-ecdsa.c | 10 +---------
+ cipher/ecc-gost.c | 2 ++
+ cipher/pubkey-internal.h | 1 +
+ 5 files changed, 30 insertions(+), 9 deletions(-)
+
+diff --git a/cipher/dsa-common.c b/cipher/dsa-common.c
+index 8c0a6843..fe49248d 100644
+--- a/cipher/dsa-common.c
++++ b/cipher/dsa-common.c
+@@ -29,6 +29,30 @@
+ #include "pubkey-internal.h"
+
+
++/*
++ * Modify K, so that computation time difference can be small,
++ * by making K large enough.
++ *
++ * Originally, (EC)DSA computation requires k where 0 < k < q. Here,
++ * we add q (the order), to keep k in a range: q < k < 2*q (or,
++ * addming more q, to keep k in a range: 2*q < k < 3*q), so that
++ * timing difference of the EC multiply (or exponentiation) operation
++ * can be small. The result of (EC)DSA computation is same.
++ */
++void
++_gcry_dsa_modify_k (gcry_mpi_t k, gcry_mpi_t q, int qbits)
++{
++ gcry_mpi_t k1 = mpi_new (qbits+2);
++
++ mpi_resize (k, (qbits+2+BITS_PER_MPI_LIMB-1) / BITS_PER_MPI_LIMB);
++ k->nlimbs = k->alloced;
++ mpi_add (k, k, q);
++ mpi_add (k1, k, q);
++ mpi_set_cond (k, k1, !mpi_test_bit (k, qbits));
++
++ mpi_free (k1);
++}
++
+ /*
+ * Generate a random secret exponent K less than Q.
+ * Note that ECDSA uses this code also to generate D.
+diff --git a/cipher/dsa.c b/cipher/dsa.c
+index 22d8d782..24a53528 100644
+--- a/cipher/dsa.c
++++ b/cipher/dsa.c
+@@ -635,6 +635,8 @@ sign (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_secret_key *skey,
+ k = _gcry_dsa_gen_k (skey->q, GCRY_STRONG_RANDOM);
+ }
+
++ _gcry_dsa_modify_k (k, skey->q, qbits);
++
+ /* r = (a^k mod p) mod q */
+ mpi_powm( r, skey->g, k, skey->p );
+ mpi_fdiv_r( r, r, skey->q );
+diff --git a/cipher/ecc-ecdsa.c b/cipher/ecc-ecdsa.c
+index 84a1cf84..97966c3a 100644
+--- a/cipher/ecc-ecdsa.c
++++ b/cipher/ecc-ecdsa.c
+@@ -114,15 +114,7 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey,
+ else
+ k = _gcry_dsa_gen_k (skey->E.n, GCRY_STRONG_RANDOM);
+
+- /* Originally, ECDSA computation requires k where 0 < k < n.
+- * Here, we add n (the order of curve), to keep k in a
+- * range: n < k < 2*n, or, addming more n, keep k in a range:
+- * 2*n < k < 3*n, so that timing difference of the EC
+- * multiply operation can be small. The result is same.
+- */
+- mpi_add (k, k, skey->E.n);
+- if (!mpi_test_bit (k, qbits))
+- mpi_add (k, k, skey->E.n);
++ _gcry_dsa_modify_k (k, skey->E.n, qbits);
+
+ _gcry_mpi_ec_mul_point (&I, k, &skey->E.G, ctx);
+ if (_gcry_mpi_ec_get_affine (x, NULL, &I, ctx))
+diff --git a/cipher/ecc-gost.c b/cipher/ecc-gost.c
+index a34fa084..0362a6c7 100644
+--- a/cipher/ecc-gost.c
++++ b/cipher/ecc-gost.c
+@@ -94,6 +94,8 @@ _gcry_ecc_gost_sign (gcry_mpi_t input, ECC_secret_key *skey,
+ mpi_free (k);
+ k = _gcry_dsa_gen_k (skey->E.n, GCRY_STRONG_RANDOM);
+
++ _gcry_dsa_modify_k (k, skey->E.n, qbits);
++
+ _gcry_mpi_ec_mul_point (&I, k, &skey->E.G, ctx);
+ if (_gcry_mpi_ec_get_affine (x, NULL, &I, ctx))
+ {
+diff --git a/cipher/pubkey-internal.h b/cipher/pubkey-internal.h
+index b8167c77..d31e26f3 100644
+--- a/cipher/pubkey-internal.h
++++ b/cipher/pubkey-internal.h
+@@ -84,6 +84,7 @@ _gcry_rsa_pss_verify (gcry_mpi_t value, gcry_mpi_t encoded,
+
+
+ /*-- dsa-common.c --*/
++void _gcry_dsa_modify_k (gcry_mpi_t k, gcry_mpi_t q, int qbits);
+ gcry_mpi_t _gcry_dsa_gen_k (gcry_mpi_t q, int security_level);
+ gpg_err_code_t _gcry_dsa_gen_rfc6979_k (gcry_mpi_t *r_k,
+ gcry_mpi_t dsa_q, gcry_mpi_t dsa_x,
+--
+2.23.0
+
diff --git a/meta/recipes-support/libgcrypt/files/0001-ecc-Add-mitigation-against-timing-attack.patch b/meta/recipes-support/libgcrypt/files/0001-ecc-Add-mitigation-against-timing-attack.patch
new file mode 100644
index 0000000000..db5a55ed26
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/0001-ecc-Add-mitigation-against-timing-attack.patch
@@ -0,0 +1,70 @@
+From d5407b78cca9f9d318a4f4d2f6ba2b8388584cd9 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Wed, 17 Jul 2019 12:44:50 +0900
+Subject: [PATCH] ecc: Add mitigation against timing attack.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream-Status: Backport [https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=d5407b78c]
+CVE: CVE-2019-13627
+Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
+
+* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Add the order N to K.
+* mpi/ec.c (_gcry_mpi_ec_mul_point): Compute with NBITS of P or larger.
+
+--
+
+Cherry-picked master commit of:
+ b9577f7c89b4327edc09f2231bc8b31521102c79
+
+CVE-id: CVE-2019-13627
+GnuPG-bug-id: 4626
+Co-authored-by: Ján Jančár <johny@neuromancer.sk>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/ecc-ecdsa.c | 10 ++++++++++
+ mpi/ec.c | 6 +++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/cipher/ecc-ecdsa.c b/cipher/ecc-ecdsa.c
+index 140e8c09..84a1cf84 100644
+--- a/cipher/ecc-ecdsa.c
++++ b/cipher/ecc-ecdsa.c
+@@ -114,6 +114,16 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey,
+ else
+ k = _gcry_dsa_gen_k (skey->E.n, GCRY_STRONG_RANDOM);
+
++ /* Originally, ECDSA computation requires k where 0 < k < n.
++ * Here, we add n (the order of curve), to keep k in a
++ * range: n < k < 2*n, or, addming more n, keep k in a range:
++ * 2*n < k < 3*n, so that timing difference of the EC
++ * multiply operation can be small. The result is same.
++ */
++ mpi_add (k, k, skey->E.n);
++ if (!mpi_test_bit (k, qbits))
++ mpi_add (k, k, skey->E.n);
++
+ _gcry_mpi_ec_mul_point (&I, k, &skey->E.G, ctx);
+ if (_gcry_mpi_ec_get_affine (x, NULL, &I, ctx))
+ {
+diff --git a/mpi/ec.c b/mpi/ec.c
+index 89077cd9..adb02600 100644
+--- a/mpi/ec.c
++++ b/mpi/ec.c
+@@ -1309,7 +1309,11 @@ _gcry_mpi_ec_mul_point (mpi_point_t result,
+ unsigned int nbits;
+ int j;
+
+- nbits = mpi_get_nbits (scalar);
++ if (mpi_cmp (scalar, ctx->p) >= 0)
++ nbits = mpi_get_nbits (scalar);
++ else
++ nbits = mpi_get_nbits (ctx->p);
++
+ if (ctx->model == MPI_EC_WEIERSTRASS)
+ {
+ mpi_set_ui (result->x, 1);
+--
+2.23.0
+
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
index 11d078d44a..1bd355133e 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
@@ -24,6 +24,8 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
file://0001-Prefetch-GCM-look-up-tables.patch \
file://0002-AES-move-look-up-tables-to-.data-section-and-unshare.patch \
file://0003-GCM-move-look-up-table-to-.data-section-and-unshare-.patch \
+ file://0001-ecc-Add-mitigation-against-timing-attack.patch \
+ file://0001-dsa-ecdsa-Fix-use-of-nonce-use-larger-one.patch \
"
SRC_URI[md5sum] = "fbfdaebbbc6d7e5fbbf6ffdb3e139573"
SRC_URI[sha256sum] = "f638143a0672628fde0cad745e9b14deb85dffb175709cacc1f4fe24b93f2227"
--
2.21.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* ✗ patchtest: failure for Consolidated zeus pull request
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
` (6 preceding siblings ...)
2019-11-10 14:54 ` [PATCH 7/7] libgcrypt: fix CVE-2019-13627 Anuj Mittal
@ 2019-11-10 15:02 ` Patchwork
7 siblings, 0 replies; 9+ messages in thread
From: Patchwork @ 2019-11-10 15:02 UTC (permalink / raw)
To: Anuj Mittal; +Cc: openembedded-core
== Series Details ==
Series: Consolidated zeus pull request
Revision: 1
URL : https://patchwork.openembedded.org/series/21070/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
series by patchtest resulting in the following failures:
* Issue Series does not apply on top of target branch [test_series_merge_on_head]
Suggested fix Rebase your series on top of targeted branch
Targeted branch master (currently at a0c238d40a)
* Patch [2/7] python3: Upgrade 3.7.4 -> 3.7.5
Issue Missing or incorrectly formatted CVE tag in included patch file [test_cve_tag_format]
Suggested fix Correct or include the CVE tag on cve patch with format: "CVE: CVE-YYYY-XXXX"
If you believe any of these test results are incorrect, please reply to the
mailing list (openembedded-core@lists.openembedded.org) raising your concerns.
Otherwise we would appreciate you correcting the issues and submitting a new
version of the patchset if applicable. Please ensure you add/increment the
version number when sending the new version (i.e. [PATCH] -> [PATCH v2] ->
[PATCH v3] -> ...).
---
Guidelines: https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2019-11-10 15:02 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-11-10 14:54 [PATCH 0/7] Consolidated zeus pull request Anuj Mittal
2019-11-10 14:54 ` [PATCH 1/7] libxslt: fix CVE-2019-18197 Anuj Mittal
2019-11-10 14:54 ` [PATCH 2/7] python3: Upgrade 3.7.4 -> 3.7.5 Anuj Mittal
2019-11-10 14:54 ` [PATCH 3/7] libpng: whitelist CVE-2019-17371 Anuj Mittal
2019-11-10 14:54 ` [PATCH 4/7] procps: whitelist CVE-2018-1121 Anuj Mittal
2019-11-10 14:54 ` [PATCH 5/7] libsndfile1: whitelist CVE-2018-13419 Anuj Mittal
2019-11-10 14:54 ` [PATCH 6/7] libpam: set CVE_PRODUCT Anuj Mittal
2019-11-10 14:54 ` [PATCH 7/7] libgcrypt: fix CVE-2019-13627 Anuj Mittal
2019-11-10 15:02 ` ✗ patchtest: failure for Consolidated zeus pull request Patchwork
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.