[Buildroot] [PATCH 0/4] Fix Busybox CVEs and bump to 1.37.0

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello,

This series started from the proposed Busybox 1.37.0 bump from Clément
Ramirez, and was expanded to address other Busybox issues.

First, we fix the remaining CVEs that affect 1.36.1. Since the
backport from upstreaming was a bit tedious, we took advantage of the
backports that OpenEmbedded had already done. This will allow those
security fixes to be easily backport to 2024.02.x, without having to
bump to 1.37.0.

We also fix a build issue on RISC-V 32-bit musl configurations, by
using another patch from meta-riscv.

And finally, we do the bump to 1.37.0. Compared to Clément's previous
submission, we adjusted on top of the previous patches, we added a fix
for the syslogd issue reported by Bernd, and we improved the commit
log.

The Busybox CI tests are passing:

15:02:43 TestInitSystemBusyboxRwNet               Starting
15:02:44 TestInitSystemBusyboxRwNet               Building
15:05:58 TestInitSystemBusyboxRwNet               Building done
15:06:04 TestInitSystemBusyboxRwNet               Cleaning up
.15:06:04 TestInitSystemBusyboxRw                  Starting
15:06:05 TestInitSystemBusyboxRw                  Building
15:09:19 TestInitSystemBusyboxRw                  Building done
15:09:25 TestInitSystemBusyboxRw                  Cleaning up
.15:09:25 TestInitSystemBusyboxRoNet               Starting
15:09:26 TestInitSystemBusyboxRoNet               Building
15:12:29 TestInitSystemBusyboxRoNet               Building done
15:12:35 TestInitSystemBusyboxRoNet               Cleaning up
.15:12:35 TestInitSystemBusyboxRo                  Starting
15:12:36 TestInitSystemBusyboxRo                  Building
15:15:38 TestInitSystemBusyboxRo                  Building done
15:15:44 TestInitSystemBusyboxRo                  Cleaning up
.
Ran 4 tests in 781.049s
OK

Clement Ramirez (1):
  package/busybox bump version to 1.37.0

Thomas Petazzoni (3):
  package/busybox: fix patch 0009 formatting
  package/busybox: fix pending CVEs
  package/busybox: fix hwclock build issue on RISC-V 32-bit musl configs

 ...route-use-linux-if_packet.h-instead-.patch |  10 +-
 ...trip-non-l-arguments-returned-by-pkg.patch |  15 ++-
 ...tr-ensure-only-printable-characters-.patch |   4 +-
 ...e-all-printed-strings-with-printable.patch |  16 +--
 ...r-glibc-2.24-not-providing-getrandom.patch |  39 -------
 ...random-detection-for-non-glibc-libc.patch} |  30 +----
 ...failing-saying-ncurses-is-not-found.patch} |  18 +--
 ...glibc-2.24-not-providing-random-head.patch |  60 ----------
 ...Fix-compilation-with-Linux-v6.8-rc1.patch} |   4 +-
 ...8-awk.c-fix-CVE-2023-42366-bug-15874.patch |  43 ++++++++
 ...CH-and-SIGCHLD-in-hush-interrupting-.patch | 103 ------------------
 ...r-SYS_settimeofday-before-calling-sy.patch |  54 +++++++++
 ...0-libbb-sha-add-missing-sha-NI-guard.patch |  54 +++++++++
 ...ix-wrong-OPT_locallog-flag-detection.patch |  37 +++++++
 package/busybox/busybox.hash                  |   4 +-
 package/busybox/busybox.mk                    |  12 +-
 16 files changed, 240 insertions(+), 263 deletions(-)
 delete mode 100644 package/busybox/0005-seedrng-fix-for-glibc-2.24-not-providing-getrandom.patch
 rename package/busybox/{0007-seedrng-fix-getrandom-detection-for-non-glibc-libc.patch => 0005-seedrng-fix-getrandom-detection-for-non-glibc-libc.patch} (81%)
 rename package/busybox/{0009-menuconfig-gcc-failing-saying-ncurses-is-not-found.patch => 0006-menuconfig-GCC-failing-saying-ncurses-is-not-found.patch} (79%)
 delete mode 100644 package/busybox/0006-seedrng-fix-for-glibc-2.24-not-providing-random-head.patch
 rename package/busybox/{0010-Linux-v6.8-rc1-removed-the-definitions-related-to-CB.patch => 0007-tc-Fix-compilation-with-Linux-v6.8-rc1.patch} (96%)
 create mode 100644 package/busybox/0008-awk.c-fix-CVE-2023-42366-bug-15874.patch
 delete mode 100644 package/busybox/0008-shell-fix-SIGWINCH-and-SIGCHLD-in-hush-interrupting-.patch
 create mode 100644 package/busybox/0009-hwclock-Check-for-SYS_settimeofday-before-calling-sy.patch
 create mode 100644 package/busybox/0010-libbb-sha-add-missing-sha-NI-guard.patch
 create mode 100644 package/busybox/0011-syslogd-fix-wrong-OPT_locallog-flag-detection.patch

-- 
2.48.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot