* [zeus][PATCH 01/10] ghostscript: CVE-2019-14869
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 02/10] gdb: Fix CVE-2019-1010180 Anuj Mittal
` (9 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Stefan Ghinea <stefan.ghinea@windriver.com>
A flaw was found in all versions of ghostscript 9.x before 9.28,
where the `.charkeys` procedure, where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.
An attacker could abuse this flaw by creating a specially crafted
PostScript file that could escalate privileges within the Ghostscript
and access files outside of restricted areas or execute commands.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-14869
Upstream patches:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904
(From OE-Core rev: 0bb88ac63b4e1728373c6425477a32f7a6362b2c)
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../ghostscript/CVE-2019-14869-0001.patch | 70 +++++++++++++++++++
.../ghostscript/ghostscript_9.27.bb | 1 +
2 files changed, 71 insertions(+)
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14869-0001.patch
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14869-0001.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14869-0001.patch
new file mode 100644
index 0000000000..715ec1c450
--- /dev/null
+++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14869-0001.patch
@@ -0,0 +1,70 @@
+From 485904772c5f0aa1140032746e5a0abfc40f4cef Mon Sep 17 00:00:00 2001
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Tue, 5 Nov 2019 09:45:27 +0000
+Subject: [PATCH] Bug 701841: remove .forceput from /.charkeys
+
+When loading Type 1 or Truetype fonts from disk, we attempt to extend the glyph
+name table to include all identifiable glyph names from the Adobe Glyph List.
+
+In the case of Type 1 fonts, the font itself (almost always) marks the
+CharStrings dictionary as read-only, hence we have to use .forceput for that
+case.
+
+But for Truetype fonts, the CharStrings dictionary is created internally and is
+not read-only until *after* we have fully populated it (including the extended
+glyph names from the AGL), hence there is no need for .forceput, and no need to
+carry the security risk of using it.
+
+Replace with regular put.
+
+CVE: CVE-2019-14869
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/gs_ttf.ps | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Resource/Init/gs_ttf.ps b/Resource/Init/gs_ttf.ps
+index e34967d..5354ff0 100644
+--- a/Resource/Init/gs_ttf.ps
++++ b/Resource/Init/gs_ttf.ps
+@@ -1301,7 +1301,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
+ TTFDEBUG { (\n1 setting alias: ) print dup ==only
+ ( to be the same as ) print 2 index //== exec } if
+
+- 7 index 2 index 3 -1 roll exch .forceput
++ 7 index 2 index 3 -1 roll exch put
+ } forall
+ pop pop pop
+ }
+@@ -1319,7 +1319,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
+ exch pop
+ TTFDEBUG { (\n2 setting alias: ) print 1 index ==only
+ ( to use glyph index: ) print dup //== exec } if
+- 5 index 3 1 roll .forceput
++ 5 index 3 1 roll put
+ //false
+ }
+ {
+@@ -1336,7 +1336,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
+ { % CharStrings(dict) isunicode(boolean) cmap(dict) RAGL(dict) gname(name) codep(integer) gindex(integer)
+ TTFDEBUG { (\3 nsetting alias: ) print 1 index ==only
+ ( to be index: ) print dup //== exec } if
+- exch pop 5 index 3 1 roll .forceput
++ exch pop 5 index 3 1 roll put
+ }
+ {
+ pop pop
+@@ -1366,7 +1366,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
+ } ifelse
+ ]
+ TTFDEBUG { (Encoding: ) print dup === flush } if
+-} .bind executeonly odef % hides .forceput
++} .bind odef
+
+ % ---------------- CIDFontType 2 font loading ---------------- %
+
+--
+2.20.1
+
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.27.bb b/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
index 9e1f3e2f49..32f938f254 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
@@ -28,6 +28,7 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
file://CVE-2019-14811-0001.patch \
file://CVE-2019-14817-0001.patch \
file://CVE-2019-14817-0002.patch \
+ file://CVE-2019-14869-0001.patch \
"
SRC_URI = "${SRC_URI_BASE} \
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 02/10] gdb: Fix CVE-2019-1010180
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 01/10] ghostscript: CVE-2019-14869 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 03/10] bind: Whitelist CVE-2019-6470 Anuj Mittal
` (8 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Vinay Kumar <vinay.m.engg@gmail.com>
Source: git://sourceware.org/git/binutils-gdb.git
Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=23657
Backported upstream commit 950b74950f6020eda38647f22e9077ac7f68ca49 to gdb-8.3.1 sources.
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=950b74950f6020eda38647f22e9077ac7f68ca49]
(From OE-Core rev: 82a227e54e704ef9237c1613b9d3350fa26fe9dd)
Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/gdb/gdb-8.3.1.inc | 1 +
.../gdb/gdb/CVE-2019-1010180.patch | 132 ++++++++++++++++++
2 files changed, 133 insertions(+)
create mode 100644 meta/recipes-devtools/gdb/gdb/CVE-2019-1010180.patch
diff --git a/meta/recipes-devtools/gdb/gdb-8.3.1.inc b/meta/recipes-devtools/gdb/gdb-8.3.1.inc
index 39f1c48cc7..aec913f3ce 100644
--- a/meta/recipes-devtools/gdb/gdb-8.3.1.inc
+++ b/meta/recipes-devtools/gdb/gdb-8.3.1.inc
@@ -16,6 +16,7 @@ SRC_URI = "${GNU_MIRROR}/gdb/gdb-${PV}.tar.xz \
file://0009-Change-order-of-CFLAGS.patch \
file://0010-resolve-restrict-keyword-conflict.patch \
file://0011-Fix-invalid-sigprocmask-call.patch \
+ file://CVE-2019-1010180.patch \
"
SRC_URI[md5sum] = "73b6a5d8141672c62bf851cd34c4aa83"
SRC_URI[sha256sum] = "1e55b4d7cdca7b34be12f4ceae651623aa73b2fd640152313f9f66a7149757c4"
diff --git a/meta/recipes-devtools/gdb/gdb/CVE-2019-1010180.patch b/meta/recipes-devtools/gdb/gdb/CVE-2019-1010180.patch
new file mode 100644
index 0000000000..46b2b3a713
--- /dev/null
+++ b/meta/recipes-devtools/gdb/gdb/CVE-2019-1010180.patch
@@ -0,0 +1,132 @@
+From 950b74950f6020eda38647f22e9077ac7f68ca49 Mon Sep 17 00:00:00 2001
+From: Keith Seitz <keiths@redhat.com>
+Date: Wed, 16 Oct 2019 11:33:59 -0700
+Subject: [PATCH] DWARF reader: Reject sections with invalid sizes
+
+This is another fuzzer bug, gdb/23567. This time, the fuzzer has
+specifically altered the size of .debug_str:
+
+$ eu-readelf -S objdump
+Section Headers:
+[Nr] Name Type Addr Off Size ES Flags Lk Inf Al
+[31] .debug_str PROGBITS 0000000000000000 0057116d ffffffffffffffff 1 MS 0 0 1
+
+When this file is loaded into GDB, the DWARF reader crashes attempting
+to access the string table (or it may just store a bunch of nonsense):
+
+[gdb-8.3-6-fc30]
+$ gdb -nx -q objdump
+BFD: warning: /path/to/objdump has a corrupt section with a size (ffffffffffffffff) larger than the file size
+Reading symbols from /path/to/objdump...
+Segmentation fault (core dumped)
+
+Nick has already committed a BFD patch to issue the warning seen above.
+
+[gdb master 6acc1a0b]
+$ gdb -BFD: warning: /path/to/objdump has a corrupt section with a size (ffffffffffffffff) larger than the file size
+Reading symbols from /path/to/objdump...
+(gdb) inf func
+All defined functions:
+
+File ./../include/dwarf2.def:
+186: const
+
+ 8 *>(.:
+ ;'@�B);
+747: const
+
+ 8 *�(.:
+ ;'@�B);
+701: const
+
+ 8 *�D �
+ (.:
+ ;'@�B);
+71: const
+
+ 8 *(.:
+ ;'@�B);
+/* and more gibberish */
+
+Consider read_indirect_string_at_offset_from:
+
+static const char *
+read_indirect_string_at_offset_from (struct objfile *objfile,
+ bfd *abfd, LONGEST str_offset,
+ struct dwarf2_section_info *sect,
+ const char *form_name,
+ const char *sect_name)
+{
+ dwarf2_read_section (objfile, sect);
+ if (sect->buffer == NULL)
+ error (_("%s used without %s section [in module %s]"),
+ form_name, sect_name, bfd_get_filename (abfd));
+ if (str_offset >= sect->size)
+ error (_("%s pointing outside of %s section [in module %s]"),
+ form_name, sect_name, bfd_get_filename (abfd));
+ gdb_assert (HOST_CHAR_BIT == 8);
+ if (sect->buffer[str_offset] == '\0')
+ return NULL;
+ return (const char *) (sect->buffer + str_offset);
+}
+
+With sect_size being ginormous, the code attempts to access
+sect->buffer[GINORMOUS], and depending on the layout of memory,
+GDB either stores a bunch of gibberish strings or crashes.
+
+This is an attempt to mitigate this by implementing a similar approach
+used by BFD. In our case, we simply reject the section with the invalid
+length:
+
+$ ./gdb -nx -q objdump
+BFD: warning: /path/to/objdump has a corrupt section with a size (ffffffffffffffff) larger than the file size
+Reading symbols from /path/to/objdump...
+
+warning: Discarding section .debug_str which has a section size (ffffffffffffffff) larger than the file size [in module /path/to/objdump]
+DW_FORM_strp used without .debug_str section [in module /path/to/objdump]
+(No debugging symbols found in /path/to/objdump)
+(gdb)
+
+Unfortunately, I have not found a way to regression test this, since it
+requires poking ELF section headers.
+
+gdb/ChangeLog:
+2019-10-16 Keith Seitz <keiths@redhat.com>
+
+ PR gdb/23567
+ * dwarf2read.c (dwarf2_per_objfile::locate_sections): Discard
+ sections whose size is greater than the file size.
+
+Change-Id: I896ac3b4eb2207c54e8e05c16beab3051d9b4b2f
+
+CVE: CVE-2019-1010180
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=950b74950f6020eda38647f22e9077ac7f68ca49]
+[Removed Changelog entry]
+Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com>
+---
+ gdb/dwarf2read.c | 9 +++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
+index 0443b55..a78f818 100644
+--- a/gdb/dwarf2read.c
++++ b/gdb/dwarf2read.c
+@@ -2338,6 +2338,15 @@ dwarf2_per_objfile::locate_sections (bfd *abfd, asection *sectp,
+ if ((aflag & SEC_HAS_CONTENTS) == 0)
+ {
+ }
++ else if (elf_section_data (sectp)->this_hdr.sh_size
++ > bfd_get_file_size (abfd))
++ {
++ bfd_size_type size = elf_section_data (sectp)->this_hdr.sh_size;
++ warning (_("Discarding section %s which has a section size (%s"
++ ") larger than the file size [in module %s]"),
++ bfd_section_name (abfd, sectp), phex_nz (size, sizeof (size)),
++ bfd_get_filename (abfd));
++ }
+ else if (section_is_p (sectp->name, &names.info))
+ {
+ this->info.s.section = sectp;
+--
+2.7.4
+
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 03/10] bind: Whitelist CVE-2019-6470
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 01/10] ghostscript: CVE-2019-14869 Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 02/10] gdb: Fix CVE-2019-1010180 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 04/10] go: fix CVE-2019-17596 Anuj Mittal
` (7 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-connectivity/bind/bind_9.11.5-P4.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-connectivity/bind/bind_9.11.5-P4.bb b/meta/recipes-connectivity/bind/bind_9.11.5-P4.bb
index 92fd628e7d..b0bb64b7c7 100644
--- a/meta/recipes-connectivity/bind/bind_9.11.5-P4.bb
+++ b/meta/recipes-connectivity/bind/bind_9.11.5-P4.bb
@@ -37,6 +37,10 @@ UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# stay at 9.11 until 9.16, from 9.16 follow the ESV versions divisible by 4
UPSTREAM_CHECK_REGEX = "(?P<pver>9.(11|16|20|24|28)(\.\d+)+(-P\d+)*)/"
+# BIND >= 9.11.2 need dhcpd >= 4.4.0,
+# don't report it here since dhcpd is already recent enough.
+CVE_CHECK_WHITELIST += "CVE-2019-6470"
+
inherit autotools update-rc.d systemd useradd pkgconfig multilib_script
MULTILIB_SCRIPTS = "${PN}:${bindir}/bind9-config ${PN}:${bindir}/isc-config.sh"
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 04/10] go: fix CVE-2019-17596
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (2 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 03/10] bind: Whitelist CVE-2019-6470 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 05/10] libsoup-2.4: upgrade to 2.66.4 Anuj Mittal
` (6 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
https://github.com/golang/go/commit/2017d88dbc096381d4f348d2fb08bfb3c2b7ed73
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/go/go-1.12.inc | 1 +
.../go/go-1.12/0010-fix-CVE-2019-17596.patch | 42 +++++++++++++++++++
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.12/0010-fix-CVE-2019-17596.patch
diff --git a/meta/recipes-devtools/go/go-1.12.inc b/meta/recipes-devtools/go/go-1.12.inc
index ed14b175e6..6aecaad75d 100644
--- a/meta/recipes-devtools/go/go-1.12.inc
+++ b/meta/recipes-devtools/go/go-1.12.inc
@@ -17,6 +17,7 @@ SRC_URI += "\
file://0007-cmd-go-make-GOROOT-precious-by-default.patch \
file://0008-use-GOBUILDMODE-to-set-buildmode.patch \
file://0001-release-branch.go1.12-security-net-textproto-don-t-n.patch \
+ file://0010-fix-CVE-2019-17596.patch \
"
SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.12/0010-fix-CVE-2019-17596.patch b/meta/recipes-devtools/go/go-1.12/0010-fix-CVE-2019-17596.patch
new file mode 100644
index 0000000000..134cfab737
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.12/0010-fix-CVE-2019-17596.patch
@@ -0,0 +1,42 @@
+From f1783e1ce44a86c000a7c380a57a805c89c3efbe Mon Sep 17 00:00:00 2001
+From: Katie Hockman <katie@golang.org>
+Date: Mon, 14 Oct 2019 16:42:21 -0400
+Subject: [PATCH] crypto/dsa: prevent bad public keys from causing panic
+
+dsa.Verify might currently use a nil s inverse in a
+multiplication if the public key contains a non-prime Q,
+causing a panic. Change this to check that the mod
+inverse exists before using it.
+
+Fixes CVE-2019-17596
+
+Change-Id: I94d5f3cc38f1b5d52d38dcb1d253c71b7fd1cae7
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/572809
+Reviewed-by: Filippo Valsorda <valsorda@google.com>
+(cherry picked from commit 9119dfb0511326d4485b248b83d4fde19c95d0f7)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575232
+
+CVE: CVE-2019-17596
+Upstream-Status: Backport [https://github.com/golang/go/commit/2017d88dbc096381d4f348d2fb08bfb3c2b7ed73]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ src/crypto/dsa/dsa.go | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/crypto/dsa/dsa.go b/src/crypto/dsa/dsa.go
+index 575314b..2fc4f1f 100644
+--- a/src/crypto/dsa/dsa.go
++++ b/src/crypto/dsa/dsa.go
+@@ -279,6 +279,9 @@ func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
+ }
+
+ w := new(big.Int).ModInverse(s, pub.Q)
++ if w == nil {
++ return false
++ }
+
+ n := pub.Q.BitLen()
+ if n&7 != 0 {
+--
+2.23.0
+
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 05/10] libsoup-2.4: upgrade to 2.66.4
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (3 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 04/10] go: fix CVE-2019-17596 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 06/10] ghostscript: fix for CVE-2019-14811 is same as CVE-2019-14813 Anuj Mittal
` (5 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@intel.com>
Fixes CVE-2019-17266.
(From OE-Core rev: ffdbcd78955d43d34988991f1d217036f044167d)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Bug fix release:
https://gitlab.gnome.org/GNOME/libsoup/compare/2.66.2...2.66.4]
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../{libsoup-2.4_2.66.2.bb => libsoup-2.4_2.66.4.bb} | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/libsoup/{libsoup-2.4_2.66.2.bb => libsoup-2.4_2.66.4.bb} (89%)
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.66.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.66.4.bb
similarity index 89%
rename from meta/recipes-support/libsoup/libsoup-2.4_2.66.2.bb
rename to meta/recipes-support/libsoup/libsoup-2.4_2.66.4.bb
index 3a735cf27a..7f5f910d3d 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.66.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.66.4.bb
@@ -12,8 +12,8 @@ SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}"
SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://0001-Do-not-enforce-no-introspection-when-cross-building.patch \
"
-SRC_URI[md5sum] = "66c2ae89d6031b01337d78a2c57c75d5"
-SRC_URI[sha256sum] = "bd2ea602eba642509672812f3c99b77cbec2f3de02ba1cc8cb7206bf7de0ae2a"
+SRC_URI[md5sum] = "42016d80ecae4cf8eb416631049a273a"
+SRC_URI[sha256sum] = "8308984f1eee1c4f8c113a9c1763b2b22d981bd811b0cc82a9f3f1aa63228779"
CVE_PRODUCT = "libsoup"
@@ -28,7 +28,7 @@ PACKAGECONFIG[gssapi] = "-Dgssapi=true,-Dgssapi=false,krb5"
EXTRA_OEMESON_append = " -Dvapi=false"
-GTKDOC_MESON_OPTION = "doc"
+GTKDOC_MESON_OPTION = "gtk_doc"
# When built without gnome support, libsoup-2.4 will contain only one shared lib
# and will therefore become subject to renaming by debian.bbclass. Prevent
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 06/10] ghostscript: fix for CVE-2019-14811 is same as CVE-2019-14813
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (4 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 05/10] libsoup-2.4: upgrade to 2.66.4 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 07/10] nasm: fix CVE-2019-14248 Anuj Mittal
` (4 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813
https://www.openwall.com/lists/oss-security/2019/08/28/2
(From OE-Core rev: afef29326b4332fc87c53a5d9d43288cddcdd944)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../ghostscript/ghostscript/CVE-2019-14811-0001.patch | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
index 3f28555e8a..d4ef0996ec 100644
--- a/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
+++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
@@ -12,6 +12,7 @@ handler being used, but nevertheless, prevent access to .forceput from
.setuserparams2.
CVE: CVE-2019-14811
+CVE: CVE-2019-14813
Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 07/10] nasm: fix CVE-2019-14248
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (5 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 06/10] ghostscript: fix for CVE-2019-14811 is same as CVE-2019-14813 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 08/10] glibc: fix CVE-2019-19126 Anuj Mittal
` (3 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
See:
https://bugzilla.nasm.us/show_bug.cgi?id=3392576
(From OE-Core rev: 5ac52e78775759d2d06514ac2ae4c98e94190875)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../nasm/nasm/CVE-2019-14248.patch | 43 +++++++++++++++++++
meta/recipes-devtools/nasm/nasm_2.14.02.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2019-14248.patch
diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2019-14248.patch b/meta/recipes-devtools/nasm/nasm/CVE-2019-14248.patch
new file mode 100644
index 0000000000..d45d2cb465
--- /dev/null
+++ b/meta/recipes-devtools/nasm/nasm/CVE-2019-14248.patch
@@ -0,0 +1,43 @@
+From 93d41d82963b2cfd0b24c906f5a8daf53281b559 Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin (Intel)" <hpa@zytor.com>
+Date: Fri, 16 Aug 2019 01:12:54 -0700
+Subject: [PATCH] BR 3392576: don't segfault on a bad %pragma limit
+
+Don't segfault on a bad %pragma limit. Instead treat a NULL pointer as
+an empty string.
+
+Reported-by: Ren Kimura <rkx1209dev@gmail.com>
+Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
+
+CVE: CVE-2019-14248
+Upstream-Status: Backport [https://repo.or.cz/nasm.git/commit/93d41d82963b2cfd0b24c906f5a8daf53281b559]
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+---
+ asm/nasm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/asm/nasm.c b/asm/nasm.c
+index c84d675..65116ab 100644
+--- a/asm/nasm.c
++++ b/asm/nasm.c
+@@ -212,6 +212,11 @@ nasm_set_limit(const char *limit, const char *valstr)
+ bool rn_error;
+ int errlevel;
+
++ if (!limit)
++ limit = "";
++ if (!valstr)
++ valstr = "";
++
+ for (i = 0; i <= LIMIT_MAX; i++) {
+ if (!nasm_stricmp(limit, limit_info[i].name))
+ break;
+@@ -204,7 +209,7 @@ nasm_set_limit(const char *limit, const char *valstr)
+ errlevel = ERR_WARNING|ERR_NOFILE|ERR_USAGE;
+ else
+ errlevel = ERR_WARNING|ERR_PASS1|WARN_UNKNOWN_PRAGMA;
+- nasm_error(errlevel, "unknown limit: `%s'", limit);
++ nasm_error(errlevel, "invalid limit value: `%s'", valstr);
+ return DIRR_ERROR;
+ }
+
diff --git a/meta/recipes-devtools/nasm/nasm_2.14.02.bb b/meta/recipes-devtools/nasm/nasm_2.14.02.bb
index e4f964ce93..bd4ecea8b6 100644
--- a/meta/recipes-devtools/nasm/nasm_2.14.02.bb
+++ b/meta/recipes-devtools/nasm/nasm_2.14.02.bb
@@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=90904486f8fbf1861cf42752e1a39efe"
SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \
file://CVE-2018-19755.patch \
+ file://CVE-2019-14248.patch \
"
SRC_URI[md5sum] = "3f489aa48ad2aa1f967dc5e293bbd06f"
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 08/10] glibc: fix CVE-2019-19126
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (6 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 07/10] nasm: fix CVE-2019-14248 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 09/10] libarchive: fix CVE-2019-19221 Anuj Mittal
` (2 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
Backport from 2.30 stable branch and drop NEWS section.
(From OE-Core rev: b4d4f70380c100d8ab06557237d8d5649a885e30)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../glibc/glibc/CVE-2019-19126.patch | 32 +++++++++++++++++++
meta/recipes-core/glibc/glibc_2.30.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/CVE-2019-19126.patch
diff --git a/meta/recipes-core/glibc/glibc/CVE-2019-19126.patch b/meta/recipes-core/glibc/glibc/CVE-2019-19126.patch
new file mode 100644
index 0000000000..aead04c485
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2019-19126.patch
@@ -0,0 +1,32 @@
+From 37c90e117310728a4ad1eb998c0bbe7d79c4a398 Mon Sep 17 00:00:00 2001
+From: =?utf8?q?Marcin=20Ko=C5=9Bcielnicki?= <mwk@0x04.net>
+Date: Thu, 21 Nov 2019 00:20:15 +0100
+Subject: [PATCH] rtld: Check __libc_enable_secure before honoring
+ LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126) [BZ #25204]
+
+The problem was introduced in glibc 2.23, in commit
+b9eb92ab05204df772eb4929eccd018637c9f3e9
+("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT").
+
+(cherry picked from commit d5dfad4326fc683c813df1e37bbf5cf920591c8e)
+
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=37c90e117310728a4ad1eb998c0bbe7d79c4a398]
+CVE: CVE-2019-19126
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+---
+diff --git a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+index 975cbe2..df2cdfd 100644
+--- a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
++++ b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+@@ -31,7 +31,8 @@
+ environment variable, LD_PREFER_MAP_32BIT_EXEC. */
+ #define EXTRA_LD_ENVVARS \
+ case 21: \
+- if (memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0) \
++ if (!__libc_enable_secure \
++ && memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0) \
+ GLRO(dl_x86_cpu_features).feature[index_arch_Prefer_MAP_32BIT_EXEC] \
+ |= bit_arch_Prefer_MAP_32BIT_EXEC; \
+ break;
+--
+2.9.3
diff --git a/meta/recipes-core/glibc/glibc_2.30.bb b/meta/recipes-core/glibc/glibc_2.30.bb
index 03add3363c..7913bc2812 100644
--- a/meta/recipes-core/glibc/glibc_2.30.bb
+++ b/meta/recipes-core/glibc/glibc_2.30.bb
@@ -41,6 +41,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0026-intl-Emit-no-lines-in-bison-generated-files.patch \
file://0027-inject-file-assembly-directives.patch \
file://0028-locale-prevent-maybe-uninitialized-errors-with-Os-BZ.patch \
+ file://CVE-2019-19126.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 09/10] libarchive: fix CVE-2019-19221
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (7 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 08/10] glibc: fix CVE-2019-19126 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 13:31 ` [zeus][PATCH 10/10] dosfstools: fix CP437 error from `dosfsck -l` Anuj Mittal
2019-12-04 14:01 ` ✗ patchtest: failure for zeus -next review Patchwork
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
Also see:
https://github.com/libarchive/libarchive/issues/1276
(From OE-Core rev: 422bef7a205b9b5d48d5b0e0b2b14ac65484607a)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
.../libarchive/CVE-2019-19221.patch | 101 ++++++++++++++++++
.../libarchive/libarchive_3.4.0.bb | 1 +
2 files changed, 102 insertions(+)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2019-19221.patch
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2019-19221.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2019-19221.patch
new file mode 100644
index 0000000000..b57e87874f
--- /dev/null
+++ b/meta/recipes-extended/libarchive/libarchive/CVE-2019-19221.patch
@@ -0,0 +1,101 @@
+From 22b1db9d46654afc6f0c28f90af8cdc84a199f41 Mon Sep 17 00:00:00 2001
+From: Martin Matuska <martin@matuska.org>
+Date: Thu, 21 Nov 2019 03:08:40 +0100
+Subject: [PATCH] Bugfix and optimize archive_wstring_append_from_mbs()
+
+The cal to mbrtowc() or mbtowc() should read up to mbs_length
+bytes and not wcs_length. This avoids out-of-bounds reads.
+
+mbrtowc() and mbtowc() return (size_t)-1 wit errno EILSEQ when
+they encounter an invalid multibyte character and (size_t)-2 when
+they they encounter an incomplete multibyte character. As we return
+failure and all our callers error out it makes no sense to continue
+parsing mbs.
+
+As we allocate `len` wchars at the beginning and each wchar has
+at least one byte, there will never be need to grow the buffer,
+so the code can be left out. On the other hand, we are always
+allocatng more memory than we need.
+
+As long as wcs_length == mbs_length == len we can omit wcs_length.
+We keep the old code commented if we decide to save memory and
+use autoexpanding wcs_length in the future.
+
+Fixes #1276
+
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/22b1db9d46654afc6f0c28f90af8cdc84a199f41]
+CVE: CVE-2019-19221
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+---
+ libarchive/archive_string.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/libarchive/archive_string.c b/libarchive/archive_string.c
+index 979a418b6..bd39c96f1 100644
+--- a/libarchive/archive_string.c
++++ b/libarchive/archive_string.c
+@@ -591,7 +591,7 @@ archive_wstring_append_from_mbs(struct archive_wstring *dest,
+ * No single byte will be more than one wide character,
+ * so this length estimate will always be big enough.
+ */
+- size_t wcs_length = len;
++ // size_t wcs_length = len;
+ size_t mbs_length = len;
+ const char *mbs = p;
+ wchar_t *wcs;
+@@ -600,7 +600,11 @@ archive_wstring_append_from_mbs(struct archive_wstring *dest,
+
+ memset(&shift_state, 0, sizeof(shift_state));
+ #endif
+- if (NULL == archive_wstring_ensure(dest, dest->length + wcs_length + 1))
++ /*
++ * As we decided to have wcs_length == mbs_length == len
++ * we can use len here instead of wcs_length
++ */
++ if (NULL == archive_wstring_ensure(dest, dest->length + len + 1))
+ return (-1);
+ wcs = dest->s + dest->length;
+ /*
+@@ -609,6 +613,12 @@ archive_wstring_append_from_mbs(struct archive_wstring *dest,
+ * multi bytes.
+ */
+ while (*mbs && mbs_length > 0) {
++ /*
++ * The buffer we allocated is always big enough.
++ * Keep this code path in a comment if we decide to choose
++ * smaller wcs_length in the future
++ */
++/*
+ if (wcs_length == 0) {
+ dest->length = wcs - dest->s;
+ dest->s[dest->length] = L'\0';
+@@ -618,24 +628,20 @@ archive_wstring_append_from_mbs(struct archive_wstring *dest,
+ return (-1);
+ wcs = dest->s + dest->length;
+ }
++*/
+ #if HAVE_MBRTOWC
+- r = mbrtowc(wcs, mbs, wcs_length, &shift_state);
++ r = mbrtowc(wcs, mbs, mbs_length, &shift_state);
+ #else
+- r = mbtowc(wcs, mbs, wcs_length);
++ r = mbtowc(wcs, mbs, mbs_length);
+ #endif
+ if (r == (size_t)-1 || r == (size_t)-2) {
+ ret_val = -1;
+- if (errno == EILSEQ) {
+- ++mbs;
+- --mbs_length;
+- continue;
+- } else
+- break;
++ break;
+ }
+ if (r == 0 || r > mbs_length)
+ break;
+ wcs++;
+- wcs_length--;
++ // wcs_length--;
+ mbs += r;
+ mbs_length -= r;
+ }
diff --git a/meta/recipes-extended/libarchive/libarchive_3.4.0.bb b/meta/recipes-extended/libarchive/libarchive_3.4.0.bb
index c789cd44d2..c196382b07 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.4.0.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.4.0.bb
@@ -32,6 +32,7 @@ PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4,"
EXTRA_OECONF += "--enable-largefile"
SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
+ file://CVE-2019-19221.patch \
"
SRC_URI[md5sum] = "6046396255bd7cf6d0f6603a9bda39ac"
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* [zeus][PATCH 10/10] dosfstools: fix CP437 error from `dosfsck -l`
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (8 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 09/10] libarchive: fix CVE-2019-19221 Anuj Mittal
@ 2019-12-04 13:31 ` Anuj Mittal
2019-12-04 14:01 ` ✗ patchtest: failure for zeus -next review Patchwork
10 siblings, 0 replies; 12+ messages in thread
From: Anuj Mittal @ 2019-12-04 13:31 UTC (permalink / raw)
To: openembedded-core
From: Christopher Larson <chris_larson@mentor.com>
Fix this error seen when using dosfsck -l to list fs contents:
CP437: Invalid argument
(From OE-Core rev: 8a5fdac3c2d207b2cfac64ec2a2626c3ef154d84)
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/dosfstools/dosfstools_4.1.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-devtools/dosfstools/dosfstools_4.1.bb b/meta/recipes-devtools/dosfstools/dosfstools_4.1.bb
index 69aa81af44..23b8836670 100644
--- a/meta/recipes-devtools/dosfstools/dosfstools_4.1.bb
+++ b/meta/recipes-devtools/dosfstools/dosfstools_4.1.bb
@@ -23,3 +23,6 @@ EXTRA_OECONF = "--without-udev --enable-compat-symlinks"
CFLAGS += "-D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
BBCLASSEXTEND = "native"
+
+# Add codepage437 to avoid error from `dosfsck -l`
+RRECOMMENDS_${PN}_append_libc-glibc = " glibc-gconv-ibm437"
--
2.21.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* ✗ patchtest: failure for zeus -next review
2019-12-04 13:31 [zeus][PATCH 00/10] zeus -next review Anuj Mittal
` (9 preceding siblings ...)
2019-12-04 13:31 ` [zeus][PATCH 10/10] dosfstools: fix CP437 error from `dosfsck -l` Anuj Mittal
@ 2019-12-04 14:01 ` Patchwork
10 siblings, 0 replies; 12+ messages in thread
From: Patchwork @ 2019-12-04 14:01 UTC (permalink / raw)
To: Anuj Mittal; +Cc: openembedded-core
== Series Details ==
Series: zeus -next review
Revision: 1
URL : https://patchwork.openembedded.org/series/21451/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
series by patchtest resulting in the following failures:
* Patch [zeus,03/10] bind: Whitelist CVE-2019-6470
Issue Missing or incorrectly formatted CVE tag in included patch file [test_cve_tag_format]
Suggested fix Correct or include the CVE tag on cve patch with format: "CVE: CVE-YYYY-XXXX"
If you believe any of these test results are incorrect, please reply to the
mailing list (openembedded-core@lists.openembedded.org) raising your concerns.
Otherwise we would appreciate you correcting the issues and submitting a new
version of the patchset if applicable. Please ensure you add/increment the
version number when sending the new version (i.e. [PATCH] -> [PATCH v2] ->
[PATCH v3] -> ...).
---
Guidelines: https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
^ permalink raw reply [flat|nested] 12+ messages in thread