* [hardknott 0/9] Patch review Sept 15th
@ 2021-09-15 13:55 Armin Kuster
2021-09-15 13:55 ` [hardknott 1/9] wireshark: upgrade 3.4.7 -> 3.4.8 Armin Kuster
` (8 more replies)
0 siblings, 9 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
Please have comments back by Friday
The following changes since commit 7bd7e1da9034e72ca4262dba55f70b2b23499aae:
dlt-daemon: update from 2.18.6 to 2.18.7 (2021-09-04 10:39:29 -0700)
are available in the Git repository at:
git://git.openembedded.org/meta-openembedded-contrib stable/hardknott-nut
http://cgit.openembedded.org/meta-openembedded-contrib/log/?h=stable/hardknott-nut
Changqing Li (1):
c-ares: fix CVE-2021-3672
Joe Slater (1):
redis: fix CVE-2021-32761
Khem Raj (1):
vboxguestdrivers: Remove __divmoddi4 patch
Kristian Klausen (1):
cryptsetup: Add runtime dependency on lvm2-udevrules for udev
Peter Kjellerstedt (1):
cryptsetup: Only recommend kernel modules when building for target
Yi Zhao (1):
krb5: fix CVE-2021-36222
wangmy (1):
cjson: upgrade 1.7.14 -> 1.7.15
zangrc (1):
cryptsetup: upgrade 2.3.5 -> 2.3.6
zhengruoqin (1):
wireshark: upgrade 3.4.7 -> 3.4.8
...{wireshark_3.4.7.bb => wireshark_3.4.8.bb} | 2 +-
.../krb5/krb5/CVE-2021-36222.patch | 121 +++++++++
.../recipes-connectivity/krb5/krb5_1.17.2.bb | 1 +
...ryptsetup_2.3.5.bb => cryptsetup_2.3.6.bb} | 31 ++-
.../{cjson_1.7.14.bb => cjson_1.7.15.bb} | 2 +-
.../redis/redis/CVE-2021-32761.patch | 257 ++++++++++++++++++
meta-oe/recipes-extended/redis/redis_6.2.2.bb | 1 +
.../c-ares/c-ares/0001-CVE-2021-3672.patch | 91 +++++++
.../c-ares/c-ares/0002-CVE-2021-3672.patch | 104 +++++++
.../recipes-support/c-ares/c-ares_1.16.1.bb | 2 +
.../vboxguestdrivers/add__divmoddi4.patch | 36 ---
.../vboxguestdrivers_6.1.26.bb | 1 -
12 files changed, 595 insertions(+), 54 deletions(-)
rename meta-networking/recipes-support/wireshark/{wireshark_3.4.7.bb => wireshark_3.4.8.bb} (97%)
create mode 100644 meta-oe/recipes-connectivity/krb5/krb5/CVE-2021-36222.patch
rename meta-oe/recipes-crypto/cryptsetup/{cryptsetup_2.3.5.bb => cryptsetup_2.3.6.bb} (88%)
rename meta-oe/recipes-devtools/cjson/{cjson_1.7.14.bb => cjson_1.7.15.bb} (90%)
create mode 100644 meta-oe/recipes-extended/redis/redis/CVE-2021-32761.patch
create mode 100644 meta-oe/recipes-support/c-ares/c-ares/0001-CVE-2021-3672.patch
create mode 100644 meta-oe/recipes-support/c-ares/c-ares/0002-CVE-2021-3672.patch
delete mode 100644 meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers/add__divmoddi4.patch
--
2.25.1
^ permalink raw reply [flat|nested] 12+ messages in thread
* [hardknott 1/9] wireshark: upgrade 3.4.7 -> 3.4.8
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 2/9] cjson: upgrade 1.7.14 -> 1.7.15 Armin Kuster
` (7 subsequent siblings)
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: zhengruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 340ec8b25eafe644ab760fd784ccef217b7ee864)
[bug fix only update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../wireshark/{wireshark_3.4.7.bb => wireshark_3.4.8.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-networking/recipes-support/wireshark/{wireshark_3.4.7.bb => wireshark_3.4.8.bb} (97%)
diff --git a/meta-networking/recipes-support/wireshark/wireshark_3.4.7.bb b/meta-networking/recipes-support/wireshark/wireshark_3.4.8.bb
similarity index 97%
rename from meta-networking/recipes-support/wireshark/wireshark_3.4.7.bb
rename to meta-networking/recipes-support/wireshark/wireshark_3.4.8.bb
index 2e0fdae63b..73ccfc5f30 100644
--- a/meta-networking/recipes-support/wireshark/wireshark_3.4.7.bb
+++ b/meta-networking/recipes-support/wireshark/wireshark_3.4.8.bb
@@ -19,7 +19,7 @@ SRC_URI += " \
UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src"
-SRC_URI[sha256sum] = "6c4cee51ef997cb9d9aaee84113525a5629157d3c743d7c4e320000de804a09d"
+SRC_URI[sha256sum] = "58a7fa8dfe2010a8c8b7dcf66438c653e6493d47eb936ba48ef49d4aa4dbd725"
PE = "1"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 2/9] cjson: upgrade 1.7.14 -> 1.7.15
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
2021-09-15 13:55 ` [hardknott 1/9] wireshark: upgrade 3.4.7 -> 3.4.8 Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 3/9] krb5: fix CVE-2021-36222 Armin Kuster
` (6 subsequent siblings)
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: wangmy <wangmy@fujitsu.com>
Fixes:
Fix potential core dumped for strrchr, see https://github.com/DaveGamble/cJSON/pull/546
Fix null pointer crash in cJSON_CreateXxArray, see https://github.com/DaveGamble/cJSON/pull/538
Fix several null pointer problems on allocation failure, see https://github.com/DaveGamble/cJSON/pull/526
Fix a possible dereference of null pointer, see https://github.com/DaveGamble/cJSON/pull/519
Fix windows build failure about defining nan, see https://github.com/DaveGamble/cJSON/pull/518
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fa00ac02df4e3caabe8ba81d1700cec835bcb139)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../recipes-devtools/cjson/{cjson_1.7.14.bb => cjson_1.7.15.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-devtools/cjson/{cjson_1.7.14.bb => cjson_1.7.15.bb} (90%)
diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.14.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.15.bb
similarity index 90%
rename from meta-oe/recipes-devtools/cjson/cjson_1.7.14.bb
rename to meta-oe/recipes-devtools/cjson/cjson_1.7.15.bb
index 0e33275e23..1a4e53d508 100644
--- a/meta-oe/recipes-devtools/cjson/cjson_1.7.14.bb
+++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.15.bb
@@ -6,7 +6,7 @@ LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
SRC_URI = "git://github.com/DaveGamble/cJSON.git"
-SRCREV = "d2735278ed1c2e4556f53a7a782063b31331dbf7"
+SRCREV = "d348621ca93571343a56862df7de4ff3bc9b5667"
S = "${WORKDIR}/git"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 3/9] krb5: fix CVE-2021-36222
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
2021-09-15 13:55 ` [hardknott 1/9] wireshark: upgrade 3.4.7 -> 3.4.8 Armin Kuster
2021-09-15 13:55 ` [hardknott 2/9] cjson: upgrade 1.7.14 -> 1.7.15 Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 4/9] cryptsetup: upgrade 2.3.5 -> 2.3.6 Armin Kuster
` (5 subsequent siblings)
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Yi Zhao <yi.zhao@windriver.com>
CVE-2021-36222:
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC)
in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2
allows remote attackers to cause a NULL pointer dereference and daemon
crash. This occurs because a return value is not properly managed in a
certain situation.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-36222
Patches from:
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 620badcbf8a59fbd2cdda6ab01c4ffba1c3ee327)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../krb5/krb5/CVE-2021-36222.patch | 121 ++++++++++++++++++
.../recipes-connectivity/krb5/krb5_1.17.2.bb | 1 +
2 files changed, 122 insertions(+)
create mode 100644 meta-oe/recipes-connectivity/krb5/krb5/CVE-2021-36222.patch
diff --git a/meta-oe/recipes-connectivity/krb5/krb5/CVE-2021-36222.patch b/meta-oe/recipes-connectivity/krb5/krb5/CVE-2021-36222.patch
new file mode 100644
index 0000000000..fee6e64c15
--- /dev/null
+++ b/meta-oe/recipes-connectivity/krb5/krb5/CVE-2021-36222.patch
@@ -0,0 +1,121 @@
+From fc98f520caefff2e5ee9a0026fdf5109944b3562 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 7 Jul 2021 11:47:44 +1200
+Subject: [PATCH] Fix KDC null deref on bad encrypted challenge
+
+The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
+to avoid further processing if the armor key is NULL. However, this
+check is bypassed by a call to k5memdup0() which overwrites retval
+with 0 if the allocation succeeds. If the armor key is NULL, a call
+to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
+crash. Add a check before the k5memdup0() call to avoid overwriting
+retval.
+
+CVE-2021-36222:
+
+In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
+cause a null dereference in the KDC by sending a request containing a
+PA-ENCRYPTED-CHALLENGE padata element without using FAST.
+
+[ghudson@mit.edu: trimmed patch; added test case; edited commit
+message]
+
+ticket: 9007 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+CVE: CVE-2021-36222
+
+Upstream-Status: Backport
+[https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/kdc/kdc_preauth_ec.c | 3 ++-
+ src/tests/Makefile.in | 1 +
+ src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 49 insertions(+), 1 deletion(-)
+ create mode 100644 src/tests/t_cve-2021-36222.py
+
+diff --git a/src/kdc/kdc_preauth_ec.c b/src/kdc/kdc_preauth_ec.c
+index 7e636b3f9..43a9902cc 100644
+--- a/src/kdc/kdc_preauth_ec.c
++++ b/src/kdc/kdc_preauth_ec.c
+@@ -87,7 +87,8 @@ ec_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
+ }
+
+ /* Check for a configured FAST ec auth indicator. */
+- realmstr = k5memdup0(realm.data, realm.length, &retval);
++ if (retval == 0)
++ realmstr = k5memdup0(realm.data, realm.length, &retval);
+ if (realmstr != NULL)
+ retval = profile_get_string(context->profile, KRB5_CONF_REALMS,
+ realmstr,
+diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
+index fc6fcc0c3..1a1938306 100644
+--- a/src/tests/Makefile.in
++++ b/src/tests/Makefile.in
+@@ -166,6 +166,7 @@ check-pytests: unlockiter s4u2self
+ $(RUNPYTEST) $(srcdir)/t_cve-2012-1015.py $(PYTESTFLAGS)
+ $(RUNPYTEST) $(srcdir)/t_cve-2013-1416.py $(PYTESTFLAGS)
+ $(RUNPYTEST) $(srcdir)/t_cve-2013-1417.py $(PYTESTFLAGS)
++ $(RUNPYTEST) $(srcdir)/t_cve-2021-36222.py $(PYTESTFLAGS)
+ $(RM) au.log
+ $(RUNPYTEST) $(srcdir)/t_audit.py $(PYTESTFLAGS)
+ $(RUNPYTEST) $(srcdir)/jsonwalker.py -d $(srcdir)/au_dict.json \
+diff --git a/src/tests/t_cve-2021-36222.py b/src/tests/t_cve-2021-36222.py
+new file mode 100644
+index 000000000..57e04993b
+--- /dev/null
++++ b/src/tests/t_cve-2021-36222.py
+@@ -0,0 +1,46 @@
++import socket
++from k5test import *
++
++realm = K5Realm()
++
++# CVE-2021-36222 KDC null dereference on encrypted challenge preauth
++# without FAST
++
++s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
++a = (hostname, realm.portbase)
++
++m = ('6A81A0' '30819D' # [APPLICATION 10] SEQUENCE
++ 'A103' '0201' '05' # [1] pvno = 5
++ 'A203' '0201' '0A' # [2] msg-type = 10
++ 'A30E' '300C' # [3] padata = SEQUENCE OF
++ '300A' # SEQUENCE
++ 'A104' '0202' '008A' # [1] padata-type = PA-ENCRYPTED-CHALLENGE
++ 'A202' '0400' # [2] padata-value = ""
++ 'A48180' '307E' # [4] req-body = SEQUENCE
++ 'A007' '0305' '0000000000' # [0] kdc-options = 0
++ 'A120' '301E' # [1] cname = SEQUENCE
++ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL
++ 'A117' '3015' # [1] name-string = SEQUENCE-OF
++ '1B06' '6B7262746774' # krbtgt
++ '1B0B' '4B5242544553542E434F4D'
++ # KRBTEST.COM
++ 'A20D' '1B0B' '4B5242544553542E434F4D'
++ # [2] realm = KRBTEST.COM
++ 'A320' '301E' # [3] sname = SEQUENCE
++ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL
++ 'A117' '3015' # [1] name-string = SEQUENCE-OF
++ '1B06' '6B7262746774' # krbtgt
++ '1B0B' '4B5242544553542E434F4D'
++ # KRBTEST.COM
++ 'A511' '180F' '31393934303631303036303331375A'
++ # [5] till = 19940610060317Z
++ 'A703' '0201' '00' # [7] nonce = 0
++ 'A808' '3006' # [8] etype = SEQUENCE OF
++ '020112' '020111') # aes256-cts aes128-cts
++
++s.sendto(bytes.fromhex(m), a)
++
++# Make sure kinit still works.
++realm.kinit(realm.user_princ, password('user'))
++
++success('CVE-2021-36222 regression test')
+--
+2.25.1
+
diff --git a/meta-oe/recipes-connectivity/krb5/krb5_1.17.2.bb b/meta-oe/recipes-connectivity/krb5/krb5_1.17.2.bb
index 29bcb48b15..e6d9e3d627 100644
--- a/meta-oe/recipes-connectivity/krb5/krb5_1.17.2.bb
+++ b/meta-oe/recipes-connectivity/krb5/krb5_1.17.2.bb
@@ -30,6 +30,7 @@ SRC_URI = "http://web.mit.edu/kerberos/dist/${BPN}/${SHRT_VER}/${BP}.tar.gz \
file://etc/default/krb5-admin-server \
file://krb5-kdc.service \
file://krb5-admin-server.service \
+ file://CVE-2021-36222.patch;striplevel=2 \
"
SRC_URI[md5sum] = "aa4337fffa3b61f22dbd0167f708818f"
SRC_URI[sha256sum] = "1a4bba94df92f6d39a197a10687653e8bfbc9a2076e129f6eb92766974f86134"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 4/9] cryptsetup: upgrade 2.3.5 -> 2.3.6
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (2 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 3/9] krb5: fix CVE-2021-36222 Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 5/9] cryptsetup: Only recommend kernel modules when building for target Armin Kuster
` (4 subsequent siblings)
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: zangrc <zangrc.fnst@fujitsu.com>
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 056d0892f0e2d1eb30029dbe9810b0800e87e634)
[Bugz fix only update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../cryptsetup/{cryptsetup_2.3.5.bb => cryptsetup_2.3.6.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta-oe/recipes-crypto/cryptsetup/{cryptsetup_2.3.5.bb => cryptsetup_2.3.6.bb} (96%)
diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.5.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
similarity index 96%
rename from meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.5.bb
rename to meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
index 0da9a26e83..562ac83fb1 100644
--- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.5.bb
+++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
@@ -21,8 +21,8 @@ RDEPENDS_${PN} = " \
"
SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/v${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}/${BP}.tar.xz"
-SRC_URI[md5sum] = "408620e0df577ec04108ec0bc2b91dee"
-SRC_URI[sha256sum] = "ced9946f444d132536daf92fc8aca4277638a3c2d96e20540b2bae4d36fd70c1"
+SRC_URI[md5sum] = "504d1ab22cbc4d1a59a8d8c7ee5ed3bf"
+SRC_URI[sha256sum] = "b296b7a21ea576c2b180611ccb19d06aec8dddaedf7c704b0c6a81210c25635f"
inherit autotools gettext pkgconfig
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 5/9] cryptsetup: Only recommend kernel modules when building for target
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (3 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 4/9] cryptsetup: upgrade 2.3.5 -> 2.3.6 Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev Armin Kuster
` (3 subsequent siblings)
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Otherwise cryptsetup-native depends on the target kernel and thus the
target compiler, as can be seen by:
$ bitbake -g cryptsetup-native
$ grep 'cryptsetup.*linux-yocto' task-depends.dot
"cryptsetup-native.do_build" -> "linux-yocto.do_deploy"
"cryptsetup-native.do_build" -> "linux-yocto.do_package_write_rpm"
"cryptsetup-native.do_populate_sysroot" -> "linux-yocto.do_populate_sysroot"
$ grep 'linux-yocto.*gcc-cross' task-depends.dot
"linux-yocto.do_kernel_configme" -> "gcc-cross-x86_64.do_populate_sysroot"
"linux-yocto.do_prepare_recipe_sysroot" -> "gcc-cross-x86_64.do_populate_sysroot"
This also moves the runtime dependencies to near the end of the recipe,
which is more customary.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 497602b4840720e8351ecf961ac6f85103093750)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../cryptsetup/cryptsetup_2.3.6.bb | 25 ++++++++++---------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
index 562ac83fb1..9e83b90eab 100644
--- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
+++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
@@ -16,10 +16,6 @@ DEPENDS = " \
util-linux-libuuid \
"
-RDEPENDS_${PN} = " \
- libdevmapper \
-"
-
SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/v${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}/${BP}.tar.xz"
SRC_URI[md5sum] = "504d1ab22cbc4d1a59a8d8c7ee5ed3bf"
SRC_URI[sha256sum] = "b296b7a21ea576c2b180611ccb19d06aec8dddaedf7c704b0c6a81210c25635f"
@@ -71,14 +67,6 @@ PACKAGECONFIG[kernel] = "--with-crypto_backend=kernel"
PACKAGECONFIG[nettle] = "--with-crypto_backend=nettle,,nettle"
PACKAGECONFIG[luks2] = "--with-default-luks-format=LUKS2,--with-default-luks-format=LUKS1"
-RRECOMMENDS_${PN} = "kernel-module-aes-generic \
- kernel-module-dm-crypt \
- kernel-module-md5 \
- kernel-module-cbc \
- kernel-module-sha256-generic \
- kernel-module-xts \
-"
-
EXTRA_OECONF = "--enable-static"
# Building without largefile is not supported by upstream
EXTRA_OECONF += "--enable-largefile"
@@ -89,4 +77,17 @@ EXTRA_OECONF += "--disable-libargon2"
FILES_${PN} += "${@bb.utils.contains('DISTRO_FEATURES','systemd','${exec_prefix}/lib/tmpfiles.d/cryptsetup.conf', '', d)}"
+RDEPENDS_${PN} = " \
+ libdevmapper \
+"
+
+RRECOMMENDS_${PN}_class-target = " \
+ kernel-module-aes-generic \
+ kernel-module-dm-crypt \
+ kernel-module-md5 \
+ kernel-module-cbc \
+ kernel-module-sha256-generic \
+ kernel-module-xts \
+"
+
BBCLASSEXTEND = "native nativesdk"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (4 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 5/9] cryptsetup: Only recommend kernel modules when building for target Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2022-02-16 21:06 ` [oe] " Denys Dmytriyenko
[not found] ` <16D4603D6225FDBC.28890@lists.openembedded.org>
2021-09-15 13:55 ` [hardknott 7/9] redis: fix CVE-2021-32761 Armin Kuster
` (2 subsequent siblings)
8 siblings, 2 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Kristian Klausen <kristian@klausen.dk>
Without the udevrules cryptsetup luksOpen will be hanging with "Udev
cookie 0xd4de0f6 (semid 5) waiting for zero".
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 60b33e376b2331cd20950f0745336397790d2201)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
index 9e83b90eab..498f333810 100644
--- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
+++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
@@ -50,7 +50,7 @@ PACKAGECONFIG[veritysetup] = "--enable-veritysetup,--disable-veritysetup"
PACKAGECONFIG[cryptsetup-reencrypt] = "--enable-cryptsetup-reencrypt,--disable-cryptsetup-reencrypt"
PACKAGECONFIG[integritysetup] = "--enable-integritysetup,--disable-integritysetup"
PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux"
-PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev"
+PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev lvm2-udevrules"
PACKAGECONFIG[kernel_crypto] = "--enable-kernel_crypto,--disable-kernel_crypto"
# gcrypt-pkbdf2 requries --with-crypto_backend=gcrypt or the flag isn't
# recognized.
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 7/9] redis: fix CVE-2021-32761
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (5 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 8/9] vboxguestdrivers: Remove __divmoddi4 patch Armin Kuster
2021-09-15 13:55 ` [hardknott 9/9] c-ares: fix CVE-2021-3672 Armin Kuster
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Joe Slater <joe.slater@windriver.com>
Backport from version 6.2.5.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../redis/redis/CVE-2021-32761.patch | 257 ++++++++++++++++++
meta-oe/recipes-extended/redis/redis_6.2.2.bb | 1 +
2 files changed, 258 insertions(+)
create mode 100644 meta-oe/recipes-extended/redis/redis/CVE-2021-32761.patch
diff --git a/meta-oe/recipes-extended/redis/redis/CVE-2021-32761.patch b/meta-oe/recipes-extended/redis/redis/CVE-2021-32761.patch
new file mode 100644
index 0000000000..14992b789a
--- /dev/null
+++ b/meta-oe/recipes-extended/redis/redis/CVE-2021-32761.patch
@@ -0,0 +1,257 @@
+From 835d15b5360e277e6f95529c4d8685946a977ddd Mon Sep 17 00:00:00 2001
+From: Huang Zhw <huang_zhw@126.com>
+Date: Wed, 21 Jul 2021 21:25:19 +0800
+Subject: [PATCH 1/1] On 32 bit platform, the bit position of
+ GETBIT/SETBIT/BITFIELD/BITCOUNT,BITPOS may overflow (see CVE-2021-32761)
+ (#9191)
+
+GETBIT, SETBIT may access wrong address because of wrap.
+BITCOUNT and BITPOS may return wrapped results.
+BITFIELD may access the wrong address but also allocate insufficient memory and segfault (see CVE-2021-32761).
+
+This commit uses `uint64_t` or `long long` instead of `size_t`.
+related https://github.com/redis/redis/pull/8096
+
+At 32bit platform:
+> setbit bit 4294967295 1
+(integer) 0
+> config set proto-max-bulk-len 536870913
+OK
+> append bit "\xFF"
+(integer) 536870913
+> getbit bit 4294967296
+(integer) 0
+
+When the bit index is larger than 4294967295, size_t can't hold bit index. In the past, `proto-max-bulk-len` is limit to 536870912, so there is no problem.
+
+After this commit, bit position is stored in `uint64_t` or `long long`. So when `proto-max-bulk-len > 536870912`, 32bit platforms can still be correct.
+
+For 64bit platform, this problem still exists. The major reason is bit pos 8 times of byte pos. When proto-max-bulk-len is very larger, bit pos may overflow.
+But at 64bit platform, we don't have so long string. So this bug may never happen.
+
+Additionally this commit add a test cost `512MB` memory which is tag as `large-memory`. Make freebsd ci and valgrind ci ignore this test.
+
+(cherry picked from commit 71d452876ebf8456afaadd6b3c27988abadd1148)d
+---
+
+CVE: CVE-2021-32761
+
+Upstream-Status: Backport [835d15b5360e277e6f95529c4d8685946a977ddd]
+ https://github.com/redis/redis.git
+
+Signed-off-by: Joe Slater <joe.slater@windriver.com>
+
+---
+ .github/workflows/daily.yml | 6 +++---
+ src/bitops.c | 32 ++++++++++++++++----------------
+ src/server.h | 2 +-
+ tests/unit/bitops.tcl | 28 ++++++++++++++++++++++++++++
+ 4 files changed, 48 insertions(+), 20 deletions(-)
+
+diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
+index 9e4630e29..432971a9d 100644
+--- a/.github/workflows/daily.yml
++++ b/.github/workflows/daily.yml
+@@ -151,7 +151,7 @@ jobs:
+ run: |
+ sudo apt-get update
+ sudo apt-get install tcl8.6 valgrind -y
+- ./runtest --valgrind --verbose --clients 1 --dump-logs
++ ./runtest --valgrind --verbose --clients 1 --tags -large-memory --dump-logs
+ - name: module api test
+ run: ./runtest-moduleapi --valgrind --no-latency --verbose --clients 1
+ - name: unittest
+@@ -171,7 +171,7 @@ jobs:
+ run: |
+ sudo apt-get update
+ sudo apt-get install tcl8.6 valgrind -y
+- ./runtest --valgrind --verbose --clients 1 --dump-logs
++ ./runtest --valgrind --verbose --clients 1 --tags -large-memory --dump-logs
+ - name: module api test
+ run: ./runtest-moduleapi --valgrind --no-latency --verbose --clients 1
+
+@@ -260,7 +260,7 @@ jobs:
+ prepare: pkg install -y bash gmake lang/tcl86
+ run: >
+ gmake &&
+- ./runtest --accurate --verbose --no-latency --dump-logs &&
++ ./runtest --accurate --verbose --no-latency --tags -large-memory --dump-logs &&
+ MAKE=gmake ./runtest-moduleapi --verbose &&
+ ./runtest-sentinel &&
+ ./runtest-cluster
+diff --git a/src/bitops.c b/src/bitops.c
+index afd79ad88..f1c563a41 100644
+--- a/src/bitops.c
++++ b/src/bitops.c
+@@ -37,8 +37,8 @@
+ /* Count number of bits set in the binary array pointed by 's' and long
+ * 'count' bytes. The implementation of this function is required to
+ * work with an input string length up to 512 MB or more (server.proto_max_bulk_len) */
+-size_t redisPopcount(void *s, long count) {
+- size_t bits = 0;
++long long redisPopcount(void *s, long count) {
++ long long bits = 0;
+ unsigned char *p = s;
+ uint32_t *p4;
+ static const unsigned char bitsinbyte[256] = {0,1,1,2,1,2,2,3,1,2,2,3,2,3,3,4,1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,4,5,5,6,5,6,6,7,5,6,6,7,6,7,7,8};
+@@ -98,11 +98,11 @@ size_t redisPopcount(void *s, long count) {
+ * no zero bit is found, it returns count*8 assuming the string is zero
+ * padded on the right. However if 'bit' is 1 it is possible that there is
+ * not a single set bit in the bitmap. In this special case -1 is returned. */
+-long redisBitpos(void *s, unsigned long count, int bit) {
++long long redisBitpos(void *s, unsigned long count, int bit) {
+ unsigned long *l;
+ unsigned char *c;
+ unsigned long skipval, word = 0, one;
+- long pos = 0; /* Position of bit, to return to the caller. */
++ long long pos = 0; /* Position of bit, to return to the caller. */
+ unsigned long j;
+ int found;
+
+@@ -410,7 +410,7 @@ void printBits(unsigned char *p, unsigned long count) {
+ * If the 'hash' argument is true, and 'bits is positive, then the command
+ * will also parse bit offsets prefixed by "#". In such a case the offset
+ * is multiplied by 'bits'. This is useful for the BITFIELD command. */
+-int getBitOffsetFromArgument(client *c, robj *o, size_t *offset, int hash, int bits) {
++int getBitOffsetFromArgument(client *c, robj *o, uint64_t *offset, int hash, int bits) {
+ long long loffset;
+ char *err = "bit offset is not an integer or out of range";
+ char *p = o->ptr;
+@@ -435,7 +435,7 @@ int getBitOffsetFromArgument(client *c, robj *o, size_t *offset, int hash, int b
+ return C_ERR;
+ }
+
+- *offset = (size_t)loffset;
++ *offset = loffset;
+ return C_OK;
+ }
+
+@@ -477,7 +477,7 @@ int getBitfieldTypeFromArgument(client *c, robj *o, int *sign, int *bits) {
+ * so that the 'maxbit' bit can be addressed. The object is finally
+ * returned. Otherwise if the key holds a wrong type NULL is returned and
+ * an error is sent to the client. */
+-robj *lookupStringForBitCommand(client *c, size_t maxbit) {
++robj *lookupStringForBitCommand(client *c, uint64_t maxbit) {
+ size_t byte = maxbit >> 3;
+ robj *o = lookupKeyWrite(c->db,c->argv[1]);
+ if (checkType(c,o,OBJ_STRING)) return NULL;
+@@ -527,7 +527,7 @@ unsigned char *getObjectReadOnlyString(robj *o, long *len, char *llbuf) {
+ void setbitCommand(client *c) {
+ robj *o;
+ char *err = "bit is not an integer or out of range";
+- size_t bitoffset;
++ uint64_t bitoffset;
+ ssize_t byte, bit;
+ int byteval, bitval;
+ long on;
+@@ -566,7 +566,7 @@ void setbitCommand(client *c) {
+ void getbitCommand(client *c) {
+ robj *o;
+ char llbuf[32];
+- size_t bitoffset;
++ uint64_t bitoffset;
+ size_t byte, bit;
+ size_t bitval = 0;
+
+@@ -888,7 +888,7 @@ void bitposCommand(client *c) {
+ addReplyLongLong(c, -1);
+ } else {
+ long bytes = end-start+1;
+- long pos = redisBitpos(p+start,bytes,bit);
++ long long pos = redisBitpos(p+start,bytes,bit);
+
+ /* If we are looking for clear bits, and the user specified an exact
+ * range with start-end, we can't consider the right of the range as
+@@ -897,11 +897,11 @@ void bitposCommand(client *c) {
+ * So if redisBitpos() returns the first bit outside the range,
+ * we return -1 to the caller, to mean, in the specified range there
+ * is not a single "0" bit. */
+- if (end_given && bit == 0 && pos == bytes*8) {
++ if (end_given && bit == 0 && pos == (long long)bytes<<3) {
+ addReplyLongLong(c,-1);
+ return;
+ }
+- if (pos != -1) pos += start*8; /* Adjust for the bytes we skipped. */
++ if (pos != -1) pos += (long long)start<<3; /* Adjust for the bytes we skipped. */
+ addReplyLongLong(c,pos);
+ }
+ }
+@@ -933,12 +933,12 @@ struct bitfieldOp {
+ * GET subcommand is allowed, other subcommands will return an error. */
+ void bitfieldGeneric(client *c, int flags) {
+ robj *o;
+- size_t bitoffset;
++ uint64_t bitoffset;
+ int j, numops = 0, changes = 0;
+ struct bitfieldOp *ops = NULL; /* Array of ops to execute at end. */
+ int owtype = BFOVERFLOW_WRAP; /* Overflow type. */
+ int readonly = 1;
+- size_t highest_write_offset = 0;
++ uint64_t highest_write_offset = 0;
+
+ for (j = 2; j < c->argc; j++) {
+ int remargs = c->argc-j-1; /* Remaining args other than current. */
+@@ -1128,9 +1128,9 @@ void bitfieldGeneric(client *c, int flags) {
+ * object boundaries. */
+ memset(buf,0,9);
+ int i;
+- size_t byte = thisop->offset >> 3;
++ uint64_t byte = thisop->offset >> 3;
+ for (i = 0; i < 9; i++) {
+- if (src == NULL || i+byte >= (size_t)strlen) break;
++ if (src == NULL || i+byte >= (uint64_t)strlen) break;
+ buf[i] = src[i+byte];
+ }
+
+diff --git a/src/server.h b/src/server.h
+index 67541fe60..caf9df31c 100644
+--- a/src/server.h
++++ b/src/server.h
+@@ -1795,7 +1795,7 @@ void getRandomHexChars(char *p, size_t len);
+ void getRandomBytes(unsigned char *p, size_t len);
+ uint64_t crc64(uint64_t crc, const unsigned char *s, uint64_t l);
+ void exitFromChild(int retcode);
+-size_t redisPopcount(void *s, long count);
++long long redisPopcount(void *s, long count);
+ int redisSetProcTitle(char *title);
+ int validateProcTitleTemplate(const char *template);
+ int redisCommunicateSystemd(const char *sd_notify_msg);
+diff --git a/tests/unit/bitops.tcl b/tests/unit/bitops.tcl
+index 926f38295..534832974 100644
+--- a/tests/unit/bitops.tcl
++++ b/tests/unit/bitops.tcl
+@@ -349,3 +349,31 @@ start_server {tags {"bitops"}} {
+ }
+ }
+ }
++
++start_server {tags {"bitops large-memory"}} {
++ test "BIT pos larger than UINT_MAX" {
++ set bytes [expr (1 << 29) + 1]
++ set bitpos [expr (1 << 32)]
++ set oldval [lindex [r config get proto-max-bulk-len] 1]
++ r config set proto-max-bulk-len $bytes
++ r setbit mykey $bitpos 1
++ assert_equal $bytes [r strlen mykey]
++ assert_equal 1 [r getbit mykey $bitpos]
++ assert_equal [list 128 128 -1] [r bitfield mykey get u8 $bitpos set u8 $bitpos 255 get i8 $bitpos]
++ assert_equal $bitpos [r bitpos mykey 1]
++ assert_equal $bitpos [r bitpos mykey 1 [expr $bytes - 1]]
++ if {$::accurate} {
++ # set all bits to 1
++ set mega [expr (1 << 23)]
++ set part [string repeat "\xFF" $mega]
++ for {set i 0} {$i < 64} {incr i} {
++ r setrange mykey [expr $i * $mega] $part
++ }
++ r setrange mykey [expr $bytes - 1] "\xFF"
++ assert_equal [expr $bitpos + 8] [r bitcount mykey]
++ assert_equal -1 [r bitpos mykey 0 0 [expr $bytes - 1]]
++ }
++ r config set proto-max-bulk-len $oldval
++ r del mykey
++ } {1}
++}
+--
+2.24.1
+
diff --git a/meta-oe/recipes-extended/redis/redis_6.2.2.bb b/meta-oe/recipes-extended/redis/redis_6.2.2.bb
index a9e6eaffaa..ad675e9e04 100644
--- a/meta-oe/recipes-extended/redis/redis_6.2.2.bb
+++ b/meta-oe/recipes-extended/redis/redis_6.2.2.bb
@@ -19,6 +19,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
file://fix-CVE-2021-29477.patch \
file://fix-CVE-2021-29478.patch \
file://fix-CVE-2021-32625.patch \
+ file://CVE-2021-32761.patch \
"
SRC_URI[sha256sum] = "7a260bb74860f1b88c3d5942bf8ba60ca59f121c6dce42d3017bed6add0b9535"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 8/9] vboxguestdrivers: Remove __divmoddi4 patch
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (6 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 7/9] redis: fix CVE-2021-32761 Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
2021-09-15 13:55 ` [hardknott 9/9] c-ares: fix CVE-2021-3672 Armin Kuster
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Khem Raj <raj.khem@gmail.com>
This function has been added upstream as well, therefore the patch is no
longer needed
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Gianfranco Costamagna <locutusofborg@debian.org>
(cherry picked from commit 552269da69d3c7d366ca3ad7340de715f06005a5)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../vboxguestdrivers/add__divmoddi4.patch | 36 -------------------
.../vboxguestdrivers_6.1.26.bb | 1 -
2 files changed, 37 deletions(-)
delete mode 100644 meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers/add__divmoddi4.patch
diff --git a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers/add__divmoddi4.patch b/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers/add__divmoddi4.patch
deleted file mode 100644
index 8dd30a20ef..0000000000
--- a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers/add__divmoddi4.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-add __divmoddi4 builtin
-
-GCC 11 will generate it in code
-
-void foo(unsigned char *u8Second, unsigned int *u32Nanosecond, long long timeSpec)
-{
- long long i64Div;
- int i32Div;
- int i32Rem;
- i64Div = timeSpec;
- i32Rem = (int)(i64Div % 1000000000);
- i64Div /= 1000000000;
- *u32Nanosecond = i32Rem;
- i32Rem = (int)(i64Div % 60);
- *u8Second = i32Rem;
-}
-
-
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
---- a/src/VBox/Runtime/common/math/gcc/divdi3.c
-+++ b/src/VBox/Runtime/common/math/gcc/divdi3.c
-@@ -68,3 +68,12 @@ __divdi3(a, b)
- uq = - uq;
- return uq;
- }
-+
-+quad_t
-+__divmoddi4(quad_t a, quad_t b, quad_t* rem)
-+{
-+ quad_t d = __divdi3(a,b);
-+ *rem = a - (d*b);
-+ return d;
-+}
-+
diff --git a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_6.1.26.bb b/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_6.1.26.bb
index 1b2fb44036..d1e42a4d7a 100644
--- a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_6.1.26.bb
+++ b/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_6.1.26.bb
@@ -13,7 +13,6 @@ VBOX_NAME = "VirtualBox-${PV}"
SRC_URI = "http://download.virtualbox.org/virtualbox/${PV}/${VBOX_NAME}.tar.bz2 \
file://Makefile.utils \
- file://add__divmoddi4.patch \
"
SRC_URI[md5sum] = "fce04bbef244b4df1a50e53d132d3e6f"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [hardknott 9/9] c-ares: fix CVE-2021-3672
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
` (7 preceding siblings ...)
2021-09-15 13:55 ` [hardknott 8/9] vboxguestdrivers: Remove __divmoddi4 patch Armin Kuster
@ 2021-09-15 13:55 ` Armin Kuster
8 siblings, 0 replies; 12+ messages in thread
From: Armin Kuster @ 2021-09-15 13:55 UTC (permalink / raw)
To: openembedded-devel
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://c-ares.org/adv_20210810.html
https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../c-ares/c-ares/0001-CVE-2021-3672.patch | 91 +++++++++++++++
.../c-ares/c-ares/0002-CVE-2021-3672.patch | 104 ++++++++++++++++++
.../recipes-support/c-ares/c-ares_1.16.1.bb | 2 +
3 files changed, 197 insertions(+)
create mode 100644 meta-oe/recipes-support/c-ares/c-ares/0001-CVE-2021-3672.patch
create mode 100644 meta-oe/recipes-support/c-ares/c-ares/0002-CVE-2021-3672.patch
diff --git a/meta-oe/recipes-support/c-ares/c-ares/0001-CVE-2021-3672.patch b/meta-oe/recipes-support/c-ares/c-ares/0001-CVE-2021-3672.patch
new file mode 100644
index 0000000000..93afb838fb
--- /dev/null
+++ b/meta-oe/recipes-support/c-ares/c-ares/0001-CVE-2021-3672.patch
@@ -0,0 +1,91 @@
+From 13363ab0eb3f5a3223571d073888816bd3e650f9 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Tue, 14 Sep 2021 13:49:11 +0800
+Subject: [PATCH 1/2] ares_expand_name() should escape more characters
+
+RFC1035 5.1 specifies some reserved characters and escaping sequences
+that are allowed to be specified. Expand the list of reserved characters
+and also escape non-printable characters using the \DDD format as
+specified in the RFC.
+
+Bug Reported By: philipp.jeitner@sit.fraunhofer.de
+Fix By: Brad House (@bradh352)
+
+Upstream-Status: Backport [https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83]
+CVE: CVE-2021-3672
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ ares_expand_name.c | 41 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 38 insertions(+), 3 deletions(-)
+
+diff --git a/ares_expand_name.c b/ares_expand_name.c
+index 3a38e67..8604543 100644
+--- a/ares_expand_name.c
++++ b/ares_expand_name.c
+@@ -38,6 +38,26 @@
+ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
+ int alen);
+
++/* Reserved characters for names that need to be escaped */
++static int is_reservedch(int ch)
++{
++ switch (ch) {
++ case '"':
++ case '.':
++ case ';':
++ case '\\':
++ case '(':
++ case ')':
++ case '@':
++ case '$':
++ return 1;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ /* Expand an RFC1035-encoded domain name given by encoded. The
+ * containing message is given by abuf and alen. The result given by
+ * *s, which is set to a NUL-terminated allocated buffer. *enclen is
+@@ -117,9 +137,18 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
+ p++;
+ while (len--)
+ {
+- if (*p == '.' || *p == '\\')
++ if (!isprint(*p)) {
++ /* Output as \DDD for consistency with RFC1035 5.1 */
++ *q++ = '\\';
++ *q++ = '0' + *p / 100;
++ *q++ = '0' + (*p % 100) / 10;
++ *q++ = '0' + (*p % 10);
++ } else if (is_reservedch(*p)) {
+ *q++ = '\\';
+- *q++ = *p;
++ *q++ = *p;
++ } else {
++ *q++ = *p;
++ }
+ p++;
+ }
+ *q++ = '.';
+@@ -177,7 +206,13 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
+ encoded++;
+ while (offset--)
+ {
+- n += (*encoded == '.' || *encoded == '\\') ? 2 : 1;
++ if (!isprint(*encoded)) {
++ n += 4;
++ } else if (is_reservedch(*encoded)) {
++ n += 2;
++ } else {
++ n += 1;
++ }
+ encoded++;
+ }
+ n++;
+--
+2.17.1
+
diff --git a/meta-oe/recipes-support/c-ares/c-ares/0002-CVE-2021-3672.patch b/meta-oe/recipes-support/c-ares/c-ares/0002-CVE-2021-3672.patch
new file mode 100644
index 0000000000..e3b32f5fef
--- /dev/null
+++ b/meta-oe/recipes-support/c-ares/c-ares/0002-CVE-2021-3672.patch
@@ -0,0 +1,104 @@
+From 446225e54b4f23c08a07968433b39d62ed65afd1 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Tue, 14 Sep 2021 13:59:28 +0800
+Subject: [PATCH 2/2] ares_expand_name(): fix formatting and handling of root
+ name response
+
+Fixes issue introduced in prior commit with formatting and handling
+of parsing a root name response which should not be escaped.
+
+Fix By: Brad House
+
+Upstream-Status: Backport [https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14]
+CVE: CVE-2021-3672
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ ares_expand_name.c | 56 +++++++++++++++++++++++++++++-----------------
+ 1 file changed, 35 insertions(+), 21 deletions(-)
+
+diff --git a/ares_expand_name.c b/ares_expand_name.c
+index 8604543..af0c2e8 100644
+--- a/ares_expand_name.c
++++ b/ares_expand_name.c
+@@ -133,22 +133,30 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
+ }
+ else
+ {
+- len = *p;
++ int name_len = *p;
++ len = name_len;
+ p++;
+ while (len--)
+ {
+- if (!isprint(*p)) {
+- /* Output as \DDD for consistency with RFC1035 5.1 */
+- *q++ = '\\';
+- *q++ = '0' + *p / 100;
+- *q++ = '0' + (*p % 100) / 10;
+- *q++ = '0' + (*p % 10);
+- } else if (is_reservedch(*p)) {
+- *q++ = '\\';
+- *q++ = *p;
+- } else {
+- *q++ = *p;
+- }
++ /* Output as \DDD for consistency with RFC1035 5.1, except
++ * for the special case of a root name response */
++ if (!isprint(*p) && !(name_len == 1 && *p == 0))
++ {
++
++ *q++ = '\\';
++ *q++ = '0' + *p / 100;
++ *q++ = '0' + (*p % 100) / 10;
++ *q++ = '0' + (*p % 10);
++ }
++ else if (is_reservedch(*p))
++ {
++ *q++ = '\\';
++ *q++ = *p;
++ }
++ else
++ {
++ *q++ = *p;
++ }
+ p++;
+ }
+ *q++ = '.';
+@@ -200,19 +208,25 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
+ }
+ else if (top == 0x00)
+ {
+- offset = *encoded;
++ int name_len = *encoded;
++ offset = name_len;
+ if (encoded + offset + 1 >= abuf + alen)
+ return -1;
+ encoded++;
+ while (offset--)
+ {
+- if (!isprint(*encoded)) {
+- n += 4;
+- } else if (is_reservedch(*encoded)) {
+- n += 2;
+- } else {
+- n += 1;
+- }
++ if (!isprint(*encoded) && !(name_len == 1 && *encoded == 0))
++ {
++ n += 4;
++ }
++ else if (is_reservedch(*encoded))
++ {
++ n += 2;
++ }
++ else
++ {
++ n += 1;
++ }
+ encoded++;
+ }
+ n++;
+--
+2.17.1
+
diff --git a/meta-oe/recipes-support/c-ares/c-ares_1.16.1.bb b/meta-oe/recipes-support/c-ares/c-ares_1.16.1.bb
index 67dd701807..afcc1cc4b8 100644
--- a/meta-oe/recipes-support/c-ares/c-ares_1.16.1.bb
+++ b/meta-oe/recipes-support/c-ares/c-ares_1.16.1.bb
@@ -11,6 +11,8 @@ SRC_URI = "\
git://github.com/c-ares/c-ares.git \
file://cmake-install-libcares.pc.patch \
file://0001-fix-configure-error-mv-libcares.pc.cmakein-to-libcar.patch \
+ file://0001-CVE-2021-3672.patch \
+ file://0002-CVE-2021-3672.patch \
"
SRCREV = "74a1426ba60e2cd7977e53a22ef839c87415066e"
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [oe] [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev
2021-09-15 13:55 ` [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev Armin Kuster
@ 2022-02-16 21:06 ` Denys Dmytriyenko
[not found] ` <16D4603D6225FDBC.28890@lists.openembedded.org>
1 sibling, 0 replies; 12+ messages in thread
From: Denys Dmytriyenko @ 2022-02-16 21:06 UTC (permalink / raw)
To: Armin Kuster; +Cc: openembedded-devel
Can we also get this backported to Dunfell please?
Do you want me to submit a separate patch for this to happen?
Thanks!
On Wed, Sep 15, 2021 at 06:55:17AM -0700, Armin Kuster wrote:
> From: Kristian Klausen <kristian@klausen.dk>
>
> Without the udevrules cryptsetup luksOpen will be hanging with "Udev
> cookie 0xd4de0f6 (semid 5) waiting for zero".
>
> Signed-off-by: Khem Raj <raj.khem@gmail.com>
> (cherry picked from commit 60b33e376b2331cd20950f0745336397790d2201)
> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> ---
> meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> index 9e83b90eab..498f333810 100644
> --- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> +++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> @@ -50,7 +50,7 @@ PACKAGECONFIG[veritysetup] = "--enable-veritysetup,--disable-veritysetup"
> PACKAGECONFIG[cryptsetup-reencrypt] = "--enable-cryptsetup-reencrypt,--disable-cryptsetup-reencrypt"
> PACKAGECONFIG[integritysetup] = "--enable-integritysetup,--disable-integritysetup"
> PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux"
> -PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev"
> +PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev lvm2-udevrules"
> PACKAGECONFIG[kernel_crypto] = "--enable-kernel_crypto,--disable-kernel_crypto"
> # gcrypt-pkbdf2 requries --with-crypto_backend=gcrypt or the flag isn't
> # recognized.
> --
> 2.25.1
>
--
Regards,
Denys Dmytriyenko <denis@denix.org>
PGP: 0x420902729A92C964 - https://denix.org/0x420902729A92C964
Fingerprint: 25FC E4A5 8A72 2F69 1186 6D76 4209 0272 9A92 C964
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [oe] [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev
[not found] ` <16D4603D6225FDBC.28890@lists.openembedded.org>
@ 2022-02-22 17:55 ` Denys Dmytriyenko
0 siblings, 0 replies; 12+ messages in thread
From: Denys Dmytriyenko @ 2022-02-22 17:55 UTC (permalink / raw)
To: Armin Kuster; +Cc: openembedded-devel
Armin,
Ping. Just wanted to check if you saw this and if it got into your queue
for Dunfell. Thanks!
On Wed, Feb 16, 2022 at 04:06:16PM -0500, Denys Dmytriyenko wrote:
> Can we also get this backported to Dunfell please?
> Do you want me to submit a separate patch for this to happen?
> Thanks!
>
>
> On Wed, Sep 15, 2021 at 06:55:17AM -0700, Armin Kuster wrote:
> > From: Kristian Klausen <kristian@klausen.dk>
> >
> > Without the udevrules cryptsetup luksOpen will be hanging with "Udev
> > cookie 0xd4de0f6 (semid 5) waiting for zero".
> >
> > Signed-off-by: Khem Raj <raj.khem@gmail.com>
> > (cherry picked from commit 60b33e376b2331cd20950f0745336397790d2201)
> > Signed-off-by: Armin Kuster <akuster808@gmail.com>
> > ---
> > meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> > index 9e83b90eab..498f333810 100644
> > --- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> > +++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.3.6.bb
> > @@ -50,7 +50,7 @@ PACKAGECONFIG[veritysetup] = "--enable-veritysetup,--disable-veritysetup"
> > PACKAGECONFIG[cryptsetup-reencrypt] = "--enable-cryptsetup-reencrypt,--disable-cryptsetup-reencrypt"
> > PACKAGECONFIG[integritysetup] = "--enable-integritysetup,--disable-integritysetup"
> > PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux"
> > -PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev"
> > +PACKAGECONFIG[udev] = "--enable-udev,--disable-udev,,udev lvm2-udevrules"
> > PACKAGECONFIG[kernel_crypto] = "--enable-kernel_crypto,--disable-kernel_crypto"
> > # gcrypt-pkbdf2 requries --with-crypto_backend=gcrypt or the flag isn't
> > # recognized.
> > --
> > 2.25.1
> >
--
Regards,
Denys Dmytriyenko <denis@denix.org>
PGP: 0x420902729A92C964 - https://denix.org/0x420902729A92C964
Fingerprint: 25FC E4A5 8A72 2F69 1186 6D76 4209 0272 9A92 C964
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-02-22 17:56 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-09-15 13:55 [hardknott 0/9] Patch review Sept 15th Armin Kuster
2021-09-15 13:55 ` [hardknott 1/9] wireshark: upgrade 3.4.7 -> 3.4.8 Armin Kuster
2021-09-15 13:55 ` [hardknott 2/9] cjson: upgrade 1.7.14 -> 1.7.15 Armin Kuster
2021-09-15 13:55 ` [hardknott 3/9] krb5: fix CVE-2021-36222 Armin Kuster
2021-09-15 13:55 ` [hardknott 4/9] cryptsetup: upgrade 2.3.5 -> 2.3.6 Armin Kuster
2021-09-15 13:55 ` [hardknott 5/9] cryptsetup: Only recommend kernel modules when building for target Armin Kuster
2021-09-15 13:55 ` [hardknott 6/9] cryptsetup: Add runtime dependency on lvm2-udevrules for udev Armin Kuster
2022-02-16 21:06 ` [oe] " Denys Dmytriyenko
[not found] ` <16D4603D6225FDBC.28890@lists.openembedded.org>
2022-02-22 17:55 ` Denys Dmytriyenko
2021-09-15 13:55 ` [hardknott 7/9] redis: fix CVE-2021-32761 Armin Kuster
2021-09-15 13:55 ` [hardknott 8/9] vboxguestdrivers: Remove __divmoddi4 patch Armin Kuster
2021-09-15 13:55 ` [hardknott 9/9] c-ares: fix CVE-2021-3672 Armin Kuster
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.