Re: [Buildroot] [PATCH] package/busybox: fix CVE-2022-30065

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Quentin, All,

On 2022-09-19 13:47 +0200, Quentin Schulz spake thusly:
> From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
> 
> This fixes CVE-2022-30065 by backporting a patch from the master branch.
> 
> Cc: Quentin Schulz <foss+buildroot@0leil.net>
> Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
> 
> Cc'ing Peter for backport to stable releases
> Only build tested
> 
>  ...wk-fix-use-after-free-CVE-2022-30065.patch | 52 +++++++++++++++++++
>  package/busybox/busybox.mk                    |  3 ++
>  2 files changed, 55 insertions(+)
>  create mode 100644 package/busybox/0003-awk-fix-use-after-free-CVE-2022-30065.patch
> 
> diff --git a/package/busybox/0003-awk-fix-use-after-free-CVE-2022-30065.patch b/package/busybox/0003-awk-fix-use-after-free-CVE-2022-30065.patch
> new file mode 100644
> index 0000000000..f9bfee328e
> --- /dev/null
> +++ b/package/busybox/0003-awk-fix-use-after-free-CVE-2022-30065.patch
> @@ -0,0 +1,52 @@
> +From e06b1f0839972cc3f5b432849d574d14a8f17613 Mon Sep 17 00:00:00 2001
> +From: Natanael Copa <ncopa@alpinelinux.org>
> +Date: Fri, 17 Jun 2022 17:45:34 +0200
> +Subject: [PATCH] awk: fix use after free (CVE-2022-30065)
> +
> +fixes https://bugs.busybox.net/show_bug.cgi?id=14781
> +
> +function                                             old     new   delta
> +evaluate                                            3343    3357     +14
> +
> +Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
> +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
> +Backport: https://git.busybox.net/busybox/commit/?id=e63d7cdfdac78c6fd27e9e63150335767592b85e
> +[straightforward conflict resolution in testsuite/awk.tests]
> +Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
> +---
> + editors/awk.c       | 3 +++
> + testsuite/awk.tests | 6 ++++++
> + 2 files changed, 9 insertions(+)
> +
> +diff --git a/editors/awk.c b/editors/awk.c
> +index f6314ac72..654cbac33 100644
> +--- a/editors/awk.c
> ++++ b/editors/awk.c
> +@@ -3114,6 +3114,9 @@ static var *evaluate(node *op, var *res)
> + 
> + 		case XC( OC_MOVE ):
> + 			debug_printf_eval("MOVE\n");
> ++			/* make sure that we never return a temp var */
> ++			if (L.v == TMPVAR0)
> ++				L.v = res;
> + 			/* if source is a temporary string, jusk relink it to dest */
> + 			if (R.v == TMPVAR1
> + 			 && !(R.v->type & VF_NUMBER)
> +diff --git a/testsuite/awk.tests b/testsuite/awk.tests
> +index bcaafe8fd..156aa65eb 100755
> +--- a/testsuite/awk.tests
> ++++ b/testsuite/awk.tests
> +@@ -469,4 +469,10 @@ testing 'awk printf %% prints one %' \
> + 	"%\n" \
> + 	'' ''
> + 
> ++testing 'awk assign while test' \
> ++	"awk '\$1==\$1=\"foo\" {print \$1}'" \
> ++	"foo\n" \
> ++	"" \
> ++	"foo"
> ++
> + exit $FAILCOUNT
> +-- 
> +2.37.3
> +
> diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
> index 920f55c7fc..0f887c9734 100644
> --- a/package/busybox/busybox.mk
> +++ b/package/busybox/busybox.mk
> @@ -11,6 +11,9 @@ BUSYBOX_LICENSE = GPL-2.0, bzip2-1.0.4
>  BUSYBOX_LICENSE_FILES = LICENSE archival/libarchive/bz/LICENSE
>  BUSYBOX_CPE_ID_VENDOR = busybox
>  
> +# 0003-awk-fix-use-after-free-CVE-2022-30065.patch
> +BUSYBOX_IGNORE_CVES += CVE-2022-30065
> +
>  BUSYBOX_CFLAGS = \
>  	$(TARGET_CFLAGS)
>  
> -- 
> 2.37.3
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot