[Buildroot] [PATCH 1/1] package/cryptsetup: security bump to version 2.3.4

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix CVE-2020-14382: A vulnerability was found in upstream release
 > cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code,
 > that is effectively invoked on every device/image presenting itself as
 > LUKS2 container. The bug is in segments validation code in file
 > 'lib/luks2/luks2_json_metadata.c' in function
 > hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj)
 > where the code does not check for possible overflow on memory allocation
 > used for intervals array (see statement "intervals = malloc(first_backup
 > * sizeof(*intervals));"). Due to the bug, library can be *tricked* to
 > expect such allocation was successful but for far less memory then
 > originally expected. Later it may read data FROM image crafted by an
 > attacker and actually write such data BEYOND allocated memory.

 > https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.3/v2.3.4-ReleaseNotes

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2020.08.x, thanks.

For 2020.02.x I will instead backport the fixes.

-- 
Bye, Peter Korsgaard