From: Yann E. MORIN <yann.morin.1998@free.fr>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 1/1] package/avahi: fix CVE-2021-36217
Date: Sat, 17 Jul 2021 12:02:57 +0200 [thread overview]
Message-ID: <20210717100257.GP12203@scaer> (raw)
In-Reply-To: <20210717093313.954035-1-fontaine.fabrice@gmail.com>
Fabrice, All,
On 2021-07-17 11:33 +0200, Fabrice Fontaine spake thusly:
> Avahi 0.8 allows a local denial of service (NULL pointer dereference and
> daemon crash) against avahi-daemon via the D-Bus interface or a "ping
> .local" command.
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Applied to master, thanks.
Regards,
Yann E. MORIN.
> ---
> ...01-Fix-NULL-pointer-crashes-from-175.patch | 152 ++++++++++++++++++
> package/avahi/avahi.mk | 3 +
> 2 files changed, 155 insertions(+)
> create mode 100644 package/avahi/0001-Fix-NULL-pointer-crashes-from-175.patch
>
> diff --git a/package/avahi/0001-Fix-NULL-pointer-crashes-from-175.patch b/package/avahi/0001-Fix-NULL-pointer-crashes-from-175.patch
> new file mode 100644
> index 0000000000..7e191e8da7
> --- /dev/null
> +++ b/package/avahi/0001-Fix-NULL-pointer-crashes-from-175.patch
> @@ -0,0 +1,152 @@
> +From 9d31939e55280a733d930b15ac9e4dda4497680c Mon Sep 17 00:00:00 2001
> +From: Tommi Rantala <tommi.t.rantala@nokia.com>
> +Date: Mon, 8 Feb 2021 11:04:43 +0200
> +Subject: [PATCH] Fix NULL pointer crashes from #175
> +
> +avahi-daemon is crashing when running "ping .local".
> +The crash is due to failing assertion from NULL pointer.
> +Add missing NULL pointer checks to fix it.
> +
> +Introduced in #175 - merge commit 8f75a045709a780c8cf92a6a21e9d35b593bdecd
> +
> +[Retrieved from:
> +https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c]
> +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> +---
> + avahi-core/browse-dns-server.c | 5 ++++-
> + avahi-core/browse-domain.c | 5 ++++-
> + avahi-core/browse-service-type.c | 3 +++
> + avahi-core/browse-service.c | 3 +++
> + avahi-core/browse.c | 3 +++
> + avahi-core/resolve-address.c | 5 ++++-
> + avahi-core/resolve-host-name.c | 5 ++++-
> + avahi-core/resolve-service.c | 5 ++++-
> + 8 files changed, 29 insertions(+), 5 deletions(-)
> +
> +diff --git a/avahi-core/browse-dns-server.c b/avahi-core/browse-dns-server.c
> +index 049752e9..c2d914fa 100644
> +--- a/avahi-core/browse-dns-server.c
> ++++ b/avahi-core/browse-dns-server.c
> +@@ -343,7 +343,10 @@ AvahiSDNSServerBrowser *avahi_s_dns_server_browser_new(
> + AvahiSDNSServerBrowser* b;
> +
> + b = avahi_s_dns_server_browser_prepare(server, interface, protocol, domain, type, aprotocol, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_dns_server_browser_start(b);
> +
> + return b;
> +-}
> +\ No newline at end of file
> ++}
> +diff --git a/avahi-core/browse-domain.c b/avahi-core/browse-domain.c
> +index f145d56a..06fa70c0 100644
> +--- a/avahi-core/browse-domain.c
> ++++ b/avahi-core/browse-domain.c
> +@@ -253,7 +253,10 @@ AvahiSDomainBrowser *avahi_s_domain_browser_new(
> + AvahiSDomainBrowser *b;
> +
> + b = avahi_s_domain_browser_prepare(server, interface, protocol, domain, type, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_domain_browser_start(b);
> +
> + return b;
> +-}
> +\ No newline at end of file
> ++}
> +diff --git a/avahi-core/browse-service-type.c b/avahi-core/browse-service-type.c
> +index fdd22dcd..b1fc7af8 100644
> +--- a/avahi-core/browse-service-type.c
> ++++ b/avahi-core/browse-service-type.c
> +@@ -171,6 +171,9 @@ AvahiSServiceTypeBrowser *avahi_s_service_type_browser_new(
> + AvahiSServiceTypeBrowser *b;
> +
> + b = avahi_s_service_type_browser_prepare(server, interface, protocol, domain, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_service_type_browser_start(b);
> +
> + return b;
> +diff --git a/avahi-core/browse-service.c b/avahi-core/browse-service.c
> +index 5531360c..63e0275a 100644
> +--- a/avahi-core/browse-service.c
> ++++ b/avahi-core/browse-service.c
> +@@ -184,6 +184,9 @@ AvahiSServiceBrowser *avahi_s_service_browser_new(
> + AvahiSServiceBrowser *b;
> +
> + b = avahi_s_service_browser_prepare(server, interface, protocol, service_type, domain, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_service_browser_start(b);
> +
> + return b;
> +diff --git a/avahi-core/browse.c b/avahi-core/browse.c
> +index 2941e579..e8a915e9 100644
> +--- a/avahi-core/browse.c
> ++++ b/avahi-core/browse.c
> +@@ -634,6 +634,9 @@ AvahiSRecordBrowser *avahi_s_record_browser_new(
> + AvahiSRecordBrowser *b;
> +
> + b = avahi_s_record_browser_prepare(server, interface, protocol, key, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_record_browser_start_query(b);
> +
> + return b;
> +diff --git a/avahi-core/resolve-address.c b/avahi-core/resolve-address.c
> +index ac0b29b1..e61dd242 100644
> +--- a/avahi-core/resolve-address.c
> ++++ b/avahi-core/resolve-address.c
> +@@ -286,7 +286,10 @@ AvahiSAddressResolver *avahi_s_address_resolver_new(
> + AvahiSAddressResolver *b;
> +
> + b = avahi_s_address_resolver_prepare(server, interface, protocol, address, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_address_resolver_start(b);
> +
> + return b;
> +-}
> +\ No newline at end of file
> ++}
> +diff --git a/avahi-core/resolve-host-name.c b/avahi-core/resolve-host-name.c
> +index 808b0e72..4e8e5973 100644
> +--- a/avahi-core/resolve-host-name.c
> ++++ b/avahi-core/resolve-host-name.c
> +@@ -318,7 +318,10 @@ AvahiSHostNameResolver *avahi_s_host_name_resolver_new(
> + AvahiSHostNameResolver *b;
> +
> + b = avahi_s_host_name_resolver_prepare(server, interface, protocol, host_name, aprotocol, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_host_name_resolver_start(b);
> +
> + return b;
> +-}
> +\ No newline at end of file
> ++}
> +diff --git a/avahi-core/resolve-service.c b/avahi-core/resolve-service.c
> +index 66bf3cae..43771763 100644
> +--- a/avahi-core/resolve-service.c
> ++++ b/avahi-core/resolve-service.c
> +@@ -519,7 +519,10 @@ AvahiSServiceResolver *avahi_s_service_resolver_new(
> + AvahiSServiceResolver *b;
> +
> + b = avahi_s_service_resolver_prepare(server, interface, protocol, name, type, domain, aprotocol, flags, callback, userdata);
> ++ if (!b)
> ++ return NULL;
> ++
> + avahi_s_service_resolver_start(b);
> +
> + return b;
> +-}
> +\ No newline at end of file
> ++}
> diff --git a/package/avahi/avahi.mk b/package/avahi/avahi.mk
> index 1d57aa14e2..9de6ebc4d2 100644
> --- a/package/avahi/avahi.mk
> +++ b/package/avahi/avahi.mk
> @@ -16,6 +16,9 @@ AVAHI_INSTALL_STAGING = YES
> # part of the Debian packaging and not part of upstream avahi
> AVAHI_IGNORE_CVES += CVE-2021-26720
>
> +# 0001-Fix-NULL-pointer-crashes-from-175.patch
> +AVAHI_IGNORE_CVES += CVE-2021-36217
> +
> AVAHI_CONF_ENV = \
> avahi_cv_sys_cxx_works=yes \
> DATADIRNAME=share
> --
> 2.30.2
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
next prev parent reply other threads:[~2021-07-17 10:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-17 9:33 [Buildroot] [PATCH 1/1] package/avahi: fix CVE-2021-36217 Fabrice Fontaine
2021-07-17 10:02 ` Yann E. MORIN [this message]
2021-08-03 19:57 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210717100257.GP12203@scaer \
--to=yann.morin.1998@free.fr \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox