Re: [Buildroot] [PATCH 1/1] package/sysstat: security bump to version 12.6.1

From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/sysstat: security bump to version 12.6.1
Date: Sun, 20 Nov 2022 10:09:45 +0100	[thread overview]
Message-ID: <20221120090945.GQ2123054@scaer> (raw)
In-Reply-To: <20221119233706.52949-1-fontaine.fabrice@gmail.com>

Fabrice, All,

On 2022-11-20 00:37 +0100, Fabrice Fontaine spake thusly:
> Fix CVE-2022-39377: sysstat is a set of system performance tools for the
> Linux operating system. On 32 bit systems, in versions 9.1.16 and newer
> but prior to 12.7.1, allocate_structures contains a size_t overflow in

As you quote the NVD description, it states that versions lower than
12.7.1 are impacted, yet you only bump to 12.6.1.

Also, the pointer you provided to the changelog does not mention
CVE-2022-39377. Besides, github warns that it is not part of the
sysstat repository (/!\ This commit does not belong to any branch on
this repository, and may belong to a fork outside of the repository).

Can you double-check, please: if 12.6.1 indeed fixes the issue, then
extend the commit log with the appropriate references; if not then we
should bump to 12.7.1.

Regards,
Yann E. MORIN.

> sa_common.c. The allocate_structures function insufficiently checks
> bounds before arithmetic multiplication, allowing for an overflow in the
> size allocated for the buffer representing system activities. This issue
> may lead to Remote Code Execution (RCE).
> 
> https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x
> https://github.com/sysstat/sysstat/blob/v12.6.1/CHANGES
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
>  package/sysstat/sysstat.hash | 4 ++--
>  package/sysstat/sysstat.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/package/sysstat/sysstat.hash b/package/sysstat/sysstat.hash
> index b573f312c6..b47f000e57 100644
> --- a/package/sysstat/sysstat.hash
> +++ b/package/sysstat/sysstat.hash
> @@ -1,5 +1,5 @@
>  # From: http://sebastien.godard.pagesperso-orange.fr/download.html
> -sha1  1e38bc029979def730ae1fb1e39f631bd1a3bc73  sysstat-12.4.2.tar.xz
> +sha1  a730982e0c2d4964a0022c1509f3ea0a345402bc  sysstat-12.6.1.tar.xz
>  # Locally calculated
> -sha256  3701b2c1883d50eb384d7b95ce5b6df0a71fdcb3c23f96cb58098d1bcffa018f  sysstat-12.4.2.tar.xz
> +sha256  18ff5a4e149e2568e43385637f72437fe6bafcc1322a93d13d1981e9464a0342  sysstat-12.6.1.tar.xz
>  sha256  db296f2f7f35bca3a174efb0eb392b3b17bd94b341851429a3dff411b1c2fc73  COPYING
> diff --git a/package/sysstat/sysstat.mk b/package/sysstat/sysstat.mk
> index 6948f6b390..377396d986 100644
> --- a/package/sysstat/sysstat.mk
> +++ b/package/sysstat/sysstat.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -SYSSTAT_VERSION = 12.4.2
> +SYSSTAT_VERSION = 12.6.1
>  SYSSTAT_SOURCE = sysstat-$(SYSSTAT_VERSION).tar.xz
>  SYSSTAT_SITE = http://pagesperso-orange.fr/sebastien.godard
>  SYSSTAT_CONF_OPTS = --disable-file-attr
> -- 
> 2.35.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot