* [OE-core][kirkstone 00/11] Patch review
@ 2023-01-12 2:33 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-01-12 2:33 UTC (permalink / raw)
To: openembedded-core
Please review these patches for kirkstone and have comments back by
end of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4779
The following changes since commit 96d9b5ba9bdb394c2a0b67bf0067a01578178e50:
oeqa/concurrencytest: Add number of failures to summary output (2023-01-04 05:08:37 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (2):
libarchive: upgrade 3.6.1 -> 3.6.2
devtool: process local files only for the main branch
Changqing Li (1):
base.bbclass: Fix way to check ccache path
Hitendra Prajapati (1):
systemd: CVE-2022-45873 deadlock in systemd-coredump via a crash with
a long backtrace
Jose Quaresma (2):
Revert "gstreamer1.0: disable flaky gstbin:test_watch_for_state_change
test"
gstreamer1.0: Fix race conditions in gstbin tests
Luis (1):
rm_work.bbclass: use HOSTTOOLS 'rm' binary exclusively
Martin Jansa (1):
systemd: backport another change from v252 to fix build with
CVE-2022-45873.patch
Narpat Mali (1):
ffmpeg: fix for CVE-2022-3109
Pavel Zhukov (1):
oeqa/rpm.py: Increase timeout and add debug output
Wang Mingyu (1):
bind: upgrade 9.18.9 -> 9.18.10
.../devtool/devtool-test-local/file3 | 1 +
.../devtool/devtool-test-local_6.03.bb | 3 +
.../devtool/devtool-test-localonly.bb | 3 +
.../devtool/devtool-test-localonly/file3 | 1 +
meta/classes/base.bbclass | 2 +-
meta/classes/rm_work.bbclass | 15 +-
meta/lib/oeqa/runtime/cases/rpm.py | 23 +-
...1-avoid-start-failure-with-bind-user.patch | 0
...d-V-and-start-log-hide-build-options.patch | 0
...ching-for-json-headers-searches-sysr.patch | 0
.../bind/{bind-9.18.9 => bind-9.18.10}/bind9 | 0
.../{bind-9.18.9 => bind-9.18.10}/conf.patch | 0
.../generate-rndc-key.sh | 0
...t.d-add-support-for-read-only-rootfs.patch | 0
.../make-etc-initd-bind-stop-work.patch | 0
.../named.service | 0
.../bind/{bind_9.18.9.bb => bind_9.18.10.bb} | 2 +-
...w-json_variant_dump-to-return-an-err.patch | 60 ++++
.../systemd/systemd/CVE-2022-45873.patch | 124 ++++++++
meta/recipes-core/systemd/systemd_250.5.bb | 2 +
.../libarchive/CVE-2022-36227.patch | 42 ---
...ibarchive_3.6.1.bb => libarchive_3.6.2.bb} | 8 +-
...-vp3-Add-missing-check-for-av_malloc.patch | 44 +++
.../recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb | 3 +-
...005-bin-Fix-race-conditions-in-tests.patch | 300 ++++++++++++++++++
...bin-test_watch_for_state_change-test.patch | 107 -------
.../gstreamer/gstreamer1.0_1.20.5.bb | 2 +-
scripts/lib/devtool/standard.py | 38 ++-
28 files changed, 590 insertions(+), 190 deletions(-)
create mode 100644 meta-selftest/recipes-test/devtool/devtool-test-local/file3
create mode 100644 meta-selftest/recipes-test/devtool/devtool-test-localonly/file3
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/0001-avoid-start-failure-with-bind-user.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/0001-named-lwresd-V-and-start-log-hide-build-options.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/bind-ensure-searching-for-json-headers-searches-sysr.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/bind9 (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/conf.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/generate-rndc-key.sh (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/init.d-add-support-for-read-only-rootfs.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/make-etc-initd-bind-stop-work.patch (100%)
rename meta/recipes-connectivity/bind/{bind-9.18.9 => bind-9.18.10}/named.service (100%)
rename meta/recipes-connectivity/bind/{bind_9.18.9.bb => bind_9.18.10.bb} (97%)
create mode 100644 meta/recipes-core/systemd/systemd/0001-shared-json-allow-json_variant_dump-to-return-an-err.patch
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2022-45873.patch
delete mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch
rename meta/recipes-extended/libarchive/{libarchive_3.6.1.bb => libarchive_3.6.2.bb} (92%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-vp3-Add-missing-check-for-av_malloc.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch
delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-tests-remove-gstbin-test_watch_for_state_change-test.patch
--
2.25.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2023-06-11 16:02 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-06-11 16:02 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5438
The following changes since commit 717b9f18a51e9c9fd5a471238aa2ea4de439ef17:
kernel-devicetree: recursively search for dtbs (2023-05-30 04:06:12 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
C. Andy Martin (1):
systemd-networkd: backport fix for rm unmanaged wifi
Hitendra Prajapati (1):
sysstat: Fix CVE-2023-33204
Michael Halstead (2):
uninative: Upgrade to 3.10 to support gcc 13
uninative: Upgrade to 4.0 to include latest gcc 13.1.1
Narpat Mali (1):
python3-requests: fix for CVE-2023-32681
Omkar Patil (1):
curl: Correction for CVE-2023-27536
Peter Marko (1):
openssl: Upgrade 3.0.8 -> 3.0.9
Richard Purdie (1):
selftest/reproducible: Allow native/cross reuse in test
Riyaz Khan (1):
openssh: Remove BSD-4-clause contents completely from codebase
Soumya (1):
perl: fix CVE-2023-31484
Vivek Kumbhar (1):
go: fix CVE-2023-24539 html/template improper sanitization of CSS
values
meta/conf/distro/include/yocto-uninative.inc | 8 +-
meta/lib/oeqa/selftest/cases/reproducible.py | 4 +-
...401bdd77ca54be6867a154cc01e0d72612e0.patch | 984 ++++++++++++++++++
.../openssh/openssh_8.9p1.bb | 1 +
...1-Configure-do-not-tweak-mips-cflags.patch | 2 +-
.../openssl/openssl/CVE-2023-0464.patch | 225 ----
.../openssl/openssl/CVE-2023-0465.patch | 56 -
.../openssl/openssl/CVE-2023-0466.patch | 50 -
.../{openssl_3.0.8.bb => openssl_3.0.9.bb} | 5 +-
...nly-managed-configs-on-reconfigure-o.patch | 358 +++++++
meta/recipes-core/systemd/systemd_250.5.bb | 1 +
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2023-24539.patch | 53 +
.../perl/files/CVE-2023-31484.patch | 29 +
meta/recipes-devtools/perl/perl_5.34.1.bb | 1 +
.../python3-requests/CVE-2023-32681.patch | 63 ++
.../python/python3-requests_2.27.1.bb | 2 +
.../sysstat/sysstat/CVE-2023-33204.patch | 80 ++
.../sysstat/sysstat_12.4.5.bb | 5 +-
.../curl/curl/CVE-2023-27536.patch | 3 +-
20 files changed, 1586 insertions(+), 345 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/7280401bdd77ca54be6867a154cc01e0d72612e0.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch
rename meta/recipes-connectivity/openssl/{openssl_3.0.8.bb => openssl_3.0.9.bb} (97%)
create mode 100644 meta/recipes-core/systemd/systemd/0001-network-remove-only-managed-configs-on-reconfigure-o.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-24539.patch
create mode 100644 meta/recipes-devtools/perl/files/CVE-2023-31484.patch
create mode 100644 meta/recipes-devtools/python/python3-requests/CVE-2023-32681.patch
create mode 100644 meta/recipes-extended/sysstat/sysstat/CVE-2023-33204.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2023-12-21 2:09 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 01/11] ghostscript: Backport fix for CVE-2023-46751 Steve Sakoman
` (10 more replies)
0 siblings, 11 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, December 22
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6355
The following changes since commit eea685e1caafd8e8121006d3f8b5d0b8a4f2a933:
build-appliance-image: Update to kirkstone head revision (2023-12-15 04:01:10 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Poonam Jadhav (1):
curl: Fix CVE-2023-46218
Richard Purdie (1):
testimage: Exclude wtmp from target-dumper commands
Soumya Sambu (2):
go: Fix CVE-2023-39326
perl: update 5.34.1 -> 5.34.3
Sourav Pramanik (1):
qemu: Fix CVE-2023-5088
Trevor Gamblin (1):
python3-ptest: skip test_storlines
Vijay Anusuri (2):
ghostscript: Backport fix for CVE-2023-46751
openssh: backport Debian patch for CVE-2023-48795
Yoann Congal (1):
externalsrc: Ensure SRCREV is processed before accessing SRC_URI
mark.yang (2):
ffmpeg: fix for CVE-2022-3964
ffmpeg: fix for CVE-2022-3965
meta/classes/externalsrc.bbclass | 4 +
meta/classes/testimage.bbclass | 2 +-
.../openssh/openssh/CVE-2023-48795.patch | 476 ++++++++++++++++++
.../fix-authorized-principals-command.patch | 30 ++
.../openssh/openssh_8.9p1.bb | 2 +
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.20/CVE-2023-39326.patch | 182 +++++++
...ile-check-the-file-if-patched-or-not.patch | 4 +-
...{perlcross_1.3.7.bb => perlcross_1.5.2.bb} | 2 +-
.../perl/{perl_5.34.1.bb => perl_5.34.3.bb} | 2 +-
...orlines-skip-due-to-load-variability.patch | 32 ++
.../python/python3_3.10.13.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-5088.patch | 112 +++++
.../ghostscript/CVE-2023-46751.patch | 41 ++
.../ghostscript/ghostscript_9.55.0.bb | 1 +
...c-stop-accessing-out-of-bounds-frame.patch | 2 +-
...c-stop-accessing-out-of-bounds-frame.patch | 1 +
.../curl/curl/CVE-2023-46218.patch | 52 ++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
20 files changed, 943 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch
create mode 100644 meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch
rename meta/recipes-devtools/perl-cross/{perlcross_1.3.7.bb => perlcross_1.5.2.bb} (92%)
rename meta/recipes-devtools/perl/{perl_5.34.1.bb => perl_5.34.3.bb} (99%)
create mode 100644 meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-46218.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 01/11] ghostscript: Backport fix for CVE-2023-46751
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 02/11] curl: Fix CVE-2023-46218 Steve Sakoman
` (9 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5d2da96e81c7455338302c71a291088a8396245a]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ghostscript/CVE-2023-46751.patch | 41 +++++++++++++++++++
.../ghostscript/ghostscript_9.55.0.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch
new file mode 100644
index 0000000000..6fe5590892
--- /dev/null
+++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch
@@ -0,0 +1,41 @@
+From 5d2da96e81c7455338302c71a291088a8396245a Mon Sep 17 00:00:00 2001
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Mon, 16 Oct 2023 16:49:40 +0100
+Subject: [PATCH] Bug 707264: Fix tiffsep(1) requirement for seekable output
+ files
+
+In the device initialization redesign, tiffsep and tiffsep1 lost the requirement
+for the output files to be seekable.
+
+Fixing that highlighted a problem with the error handling in
+gdev_prn_open_printer_seekable() where closing the erroring file would leave a
+dangling pointer, and lead to a crash.
+
+Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5d2da96e81c7455338302c71a291088a8396245a]
+CVE: CVE-2023-46751
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ base/gdevprn.c | 1 +
+ devices/gdevtsep.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/base/gdevprn.c
++++ b/base/gdevprn.c
+@@ -1251,6 +1251,7 @@ gdev_prn_open_printer_seekable(gx_device
+ && !IS_LIBCTX_STDERR(pdev->memory, gp_get_file(ppdev->file))) {
+
+ code = gx_device_close_output_file(pdev, ppdev->fname, ppdev->file);
++ ppdev->file = NULL;
+ if (code < 0)
+ return code;
+ }
+--- a/devices/gdevtsep.c
++++ b/devices/gdevtsep.c
+@@ -738,6 +738,7 @@ tiffsep_initialize_device_procs(gx_devic
+ {
+ gdev_prn_initialize_device_procs(dev);
+
++ set_dev_proc(dev, output_page, gdev_prn_output_page_seekable);
+ set_dev_proc(dev, open_device, tiffsep_prn_open);
+ set_dev_proc(dev, close_device, tiffsep_prn_close);
+ set_dev_proc(dev, map_color_rgb, tiffsep_decode_color);
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb
index 7f4050755c..e0d1e4618f 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb
@@ -42,6 +42,7 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
file://CVE-2023-36664-0002.patch \
file://CVE-2023-38559.patch \
file://CVE-2023-43115.patch \
+ file://CVE-2023-46751.patch \
"
SRC_URI = "${SRC_URI_BASE} \
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 02/11] curl: Fix CVE-2023-46218
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 01/11] ghostscript: Backport fix for CVE-2023-46751 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 03/11] qemu: Fix CVE-2023-5088 Steve Sakoman
` (8 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Poonam Jadhav <ppjadhav456@gmail.com>
Add patch to fix CVE-2023-46218
Link: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/curl/7.88.1-8ubuntu2.4/curl_7.88.1-8ubuntu2.4.debian.tar.xz
https://github.com/curl/curl/commit/2b0994c29a721c91c57
Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2023-46218.patch | 52 +++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
2 files changed, 53 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-46218.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2023-46218.patch b/meta/recipes-support/curl/curl/CVE-2023-46218.patch
new file mode 100644
index 0000000000..d7d7908ea0
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-46218.patch
@@ -0,0 +1,52 @@
+Backport of:
+
+From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 23 Nov 2023 08:15:47 +0100
+Subject: [PATCH] cookie: lowercase the domain names before PSL checks
+
+Reported-by: Harry Sintonen
+
+Closes #12387
+
+CVE: CVE-2023-46218
+Upstream-Status: Backport [https://github.com/curl/curl/commit/2b0994c29a721c91c57]
+Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
+---
+ lib/cookie.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1044,15 +1044,23 @@ Curl_cookie_add(struct Curl_easy *data,
+ * dereference it.
+ */
+ if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) {
+- const psl_ctx_t *psl = Curl_psl_use(data);
+- int acceptable;
+-
+- if(psl) {
+- acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
+- Curl_psl_release(data);
++ bool acceptable = FALSE;
++ char lcase[256];
++ char lcookie[256];
++ size_t dlen = strlen(domain);
++ size_t clen = strlen(co->domain);
++ if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
++ const psl_ctx_t *psl = Curl_psl_use(data);
++ if(psl) {
++ /* the PSL check requires lowercase domain name and pattern */
++ Curl_strntolower(lcase, domain, dlen + 1);
++ Curl_strntolower(lcookie, co->domain, clen + 1);
++ acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
++ Curl_psl_release(data);
++ }
++ else
++ acceptable = !bad_domain(domain);
+ }
+- else
+- acceptable = !bad_domain(domain);
+
+ if(!acceptable) {
+ infof(data, "cookie '%s' dropped, domain '%s' must not "
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 471bc47f34..a36d03f668 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -54,6 +54,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2023-32001.patch \
file://CVE-2023-38545.patch \
file://CVE-2023-38546.patch \
+ file://CVE-2023-46218.patch \
"
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 03/11] qemu: Fix CVE-2023-5088
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 01/11] ghostscript: Backport fix for CVE-2023-46751 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 02/11] curl: Fix CVE-2023-46218 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 04/11] ffmpeg: fix for CVE-2022-3964 Steve Sakoman
` (7 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Sourav Pramanik <sourav.pramanik@kpit.com>
A bug in QEMU could cause a guest I/O operation otherwise
addressed to an arbitrary disk offset to be targeted to
offset 0 instead (potentially overwriting the VM's boot code).
This change is to fix CVE-2023-5088.
Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e
Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com>
Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-5088.patch | 112 ++++++++++++++++++
2 files changed, 113 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index c8e4e2e6f3..c5fb9b1eab 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -102,6 +102,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2023-3180.patch \
file://CVE-2021-3638.patch \
file://CVE-2023-1544.patch \
+ file://CVE-2023-5088.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
new file mode 100644
index 0000000000..c5ea9d739a
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
@@ -0,0 +1,112 @@
+From 7d7512019fc40c577e2bdd61f114f31a9eb84a8e Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Wed, 6 Sep 2023 15:09:21 +0200
+Subject: [PATCH] hw/ide: reset: cancel async DMA operation before resetting
+ state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If there is a pending DMA operation during ide_bus_reset(), the fact
+that the IDEState is already reset before the operation is canceled
+can be problematic. In particular, ide_dma_cb() might be called and
+then use the reset IDEState which contains the signature after the
+reset. When used to construct the IO operation this leads to
+ide_get_sector() returning 0 and nsector being 1. This is particularly
+bad, because a write command will thus destroy the first sector which
+often contains a partition table or similar.
+
+Traces showing the unsolicited write happening with IDEState
+0x5595af6949d0 being used after reset:
+
+> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
+> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
+> ide_reset IDEstate 0x5595af6949d0
+> ide_reset IDEstate 0x5595af694da8
+> ide_bus_reset_aio aio_cancel
+> dma_aio_cancel dbs=0x7f64600089a0
+> dma_blk_cb dbs=0x7f64600089a0 ret=0
+> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
+> ahci_populate_sglist ahci(0x5595af6923f0)[0]
+> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
+> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
+> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
+> dma_blk_cb dbs=0x7f6420802010 ret=0
+
+> (gdb) p *qiov
+> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
+> iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
+> size = 512}}}
+> (gdb) bt
+> #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
+> cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
+> at ../block/block-backend.c:1682
+> #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
+> at ../softmmu/dma-helpers.c:179
+> #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
+> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
+> io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
+> io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
+> cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
+> dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
+> #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
+> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
+> cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
+> at ../softmmu/dma-helpers.c:280
+> #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
+> at ../hw/ide/core.c:953
+> #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
+> at ../softmmu/dma-helpers.c:107
+> #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
+> #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
+> at ../block/block-backend.c:1527
+> #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
+> #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
+> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
+> i1=<optimized out>) at ../util/coroutine-ucontext.c:177
+
+CVE: CVE-2023-5088
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e]
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Tested-by: simon.rowe@nutanix.com
+Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com>
+---
+ hw/ide/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index b5e0dcd29b2..63ba665f3d2 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -2515,19 +2515,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
+
+ void ide_bus_reset(IDEBus *bus)
+ {
+- bus->unit = 0;
+- bus->cmd = 0;
+- ide_reset(&bus->ifs[0]);
+- ide_reset(&bus->ifs[1]);
+- ide_clear_hob(bus);
+-
+- /* pending async DMA */
++ /* pending async DMA - needs the IDEState before it is reset */
+ if (bus->dma->aiocb) {
+ trace_ide_bus_reset_aio();
+ blk_aio_cancel(bus->dma->aiocb);
+ bus->dma->aiocb = NULL;
+ }
+
++ bus->unit = 0;
++ bus->cmd = 0;
++ ide_reset(&bus->ifs[0]);
++ ide_reset(&bus->ifs[1]);
++ ide_clear_hob(bus);
++
+ /* reset dma provider too */
+ if (bus->dma->ops->reset) {
+ bus->dma->ops->reset(bus->dma);
+--
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 04/11] ffmpeg: fix for CVE-2022-3964
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 03/11] qemu: Fix CVE-2023-5088 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 05/11] ffmpeg: fix for CVE-2022-3965 Steve Sakoman
` (6 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
Without a CVE tag, It will be recognised as Unpatched by cve_check task.
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch
index 23573bb6b3..97fcfd993a 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch
@@ -4,7 +4,7 @@ Date: Sat, 12 Nov 2022 16:12:00 +0100
Subject: [PATCH] avcodec/rpzaenc: stop accessing out of bounds frame
Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/92f9b28ed84a77138105475beba16c146bdaf984]
-
+CVE: CVE-2022-3964
Signed-off-by: <narpat.mali@windriver.com>
---
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 05/11] ffmpeg: fix for CVE-2022-3965
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 04/11] ffmpeg: fix for CVE-2022-3964 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 06/11] go: Fix CVE-2023-39326 Steve Sakoman
` (5 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
Without a CVE tag, It will be recognised as Unpatched by cve_check task.
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch
index 6e237fdd52..8ebf1f69c4 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch
@@ -5,6 +5,7 @@ Subject: [PATCH] avcodec/smcenc: stop accessing out of bounds frame
Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/13c13109759090b7f7182480d075e13b36ed8edd]
+CVE: CVE-2022-3965
Signed-off-by: <narpat.mali@windriver.com>
---
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 06/11] go: Fix CVE-2023-39326
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 05/11] ffmpeg: fix for CVE-2022-3965 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 07/11] openssh: backport Debian patch for CVE-2023-48795 Steve Sakoman
` (4 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Soumya Sambu <soumya.sambu@windriver.com>
A malicious HTTP sender can use chunk extensions to cause a receiver
reading from a request or response body to read many more bytes from
the network than are in the body. A malicious HTTP client can further
exploit this to cause a server to automatically read a large amount
of data (up to about 1GiB) when a handler fails to read the entire
body of a request. Chunk extensions are a little-used HTTP feature
which permit including additional metadata in a request or response
body sent using the chunked encoding. The net/http chunked encoding
reader discards this metadata. A sender can exploit this by inserting
a large metadata segment with each byte transferred. The chunk reader
now produces an error if the ratio of real body to encoded bytes grows
too small.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-39326
https://security-tracker.debian.org/tracker/CVE-2023-39326
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.20/CVE-2023-39326.patch | 182 ++++++++++++++++++
2 files changed, 183 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc
index 330f571d22..95c4461d3e 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -47,6 +47,7 @@ SRC_URI += "\
file://CVE-2023-29409.patch \
file://CVE-2023-39319.patch \
file://CVE-2023-39318.patch \
+ file://CVE-2023-39326.patch \
"
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
diff --git a/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch b/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch
new file mode 100644
index 0000000000..ca78e552c2
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch
@@ -0,0 +1,182 @@
+From 6446af942e2e2b161c4ec1b60d9703a2b55dc4dd Mon Sep 17 00:00:00 2001
+From: Damien Neil <dneil@google.com>
+Date: Tue, 7 Nov 2023 10:47:56 -0800
+Subject: [PATCH] net/http: limit chunked data overhead
+
+The chunked transfer encoding adds some overhead to
+the content transferred. When writing one byte per
+chunk, for example, there are five bytes of overhead
+per byte of data transferred: "1\r\nX\r\n" to send "X".
+
+Chunks may include "chunk extensions",
+which we skip over and do not use.
+For example: "1;chunk extension here\r\nX\r\n".
+
+A malicious sender can use chunk extensions to add
+about 4k of overhead per byte of data.
+(The maximum chunk header line size we will accept.)
+
+Track the amount of overhead read in chunked data,
+and produce an error if it seems excessive.
+
+Updates #64433
+Fixes #64434
+Fixes CVE-2023-39326
+
+Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135
+Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+(cherry picked from commit 3473ae72ee66c60744665a24b2fde143e8964d4f)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2095407
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/547355
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+
+CVE: CVE-2023-39326
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/6446af942e2e2b161c4ec1b60d9703a2b55dc4dd]
+
+Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
+---
+ src/net/http/internal/chunked.go | 36 +++++++++++++---
+ src/net/http/internal/chunked_test.go | 59 +++++++++++++++++++++++++++
+ 2 files changed, 89 insertions(+), 6 deletions(-)
+
+diff --git a/src/net/http/internal/chunked.go b/src/net/http/internal/chunked.go
+index f06e572..ddbaacb 100644
+--- a/src/net/http/internal/chunked.go
++++ b/src/net/http/internal/chunked.go
+@@ -39,7 +39,8 @@ type chunkedReader struct {
+ n uint64 // unread bytes in chunk
+ err error
+ buf [2]byte
+- checkEnd bool // whether need to check for \r\n chunk footer
++ checkEnd bool // whether need to check for \r\n chunk footer
++ excess int64 // "excessive" chunk overhead, for malicious sender detection
+ }
+
+ func (cr *chunkedReader) beginChunk() {
+@@ -49,10 +50,38 @@ func (cr *chunkedReader) beginChunk() {
+ if cr.err != nil {
+ return
+ }
++ cr.excess += int64(len(line)) + 2 // header, plus \r\n after the chunk data
++ line = trimTrailingWhitespace(line)
++ line, cr.err = removeChunkExtension(line)
++ if cr.err != nil {
++ return
++ }
+ cr.n, cr.err = parseHexUint(line)
+ if cr.err != nil {
+ return
+ }
++ // A sender who sends one byte per chunk will send 5 bytes of overhead
++ // for every byte of data. ("1\r\nX\r\n" to send "X".)
++ // We want to allow this, since streaming a byte at a time can be legitimate.
++ //
++ // A sender can use chunk extensions to add arbitrary amounts of additional
++ // data per byte read. ("1;very long extension\r\nX\r\n" to send "X".)
++ // We don't want to disallow extensions (although we discard them),
++ // but we also don't want to allow a sender to reduce the signal/noise ratio
++ // arbitrarily.
++ //
++ // We track the amount of excess overhead read,
++ // and produce an error if it grows too large.
++ //
++ // Currently, we say that we're willing to accept 16 bytes of overhead per chunk,
++ // plus twice the amount of real data in the chunk.
++ cr.excess -= 16 + (2 * int64(cr.n))
++ if cr.excess < 0 {
++ cr.excess = 0
++ }
++ if cr.excess > 16*1024 {
++ cr.err = errors.New("chunked encoding contains too much non-data")
++ }
+ if cr.n == 0 {
+ cr.err = io.EOF
+ }
+@@ -133,11 +162,6 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) {
+ if len(p) >= maxLineLength {
+ return nil, ErrLineTooLong
+ }
+- p = trimTrailingWhitespace(p)
+- p, err = removeChunkExtension(p)
+- if err != nil {
+- return nil, err
+- }
+ return p, nil
+ }
+
+diff --git a/src/net/http/internal/chunked_test.go b/src/net/http/internal/chunked_test.go
+index 08152ed..5fbeb08 100644
+--- a/src/net/http/internal/chunked_test.go
++++ b/src/net/http/internal/chunked_test.go
+@@ -211,3 +211,62 @@ func TestChunkReadPartial(t *testing.T) {
+ }
+
+ }
++
++func TestChunkReaderTooMuchOverhead(t *testing.T) {
++ // If the sender is sending 100x as many chunk header bytes as chunk data,
++ // we should reject the stream at some point.
++ chunk := []byte("1;")
++ for i := 0; i < 100; i++ {
++ chunk = append(chunk, 'a') // chunk extension
++ }
++ chunk = append(chunk, "\r\nX\r\n"...)
++ const bodylen = 1 << 20
++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) {
++ if i < bodylen {
++ return chunk, nil
++ }
++ return []byte("0\r\n"), nil
++ }})
++ _, err := io.ReadAll(r)
++ if err == nil {
++ t.Fatalf("successfully read body with excessive overhead; want error")
++ }
++}
++
++func TestChunkReaderByteAtATime(t *testing.T) {
++ // Sending one byte per chunk should not trip the excess-overhead detection.
++ const bodylen = 1 << 20
++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) {
++ if i < bodylen {
++ return []byte("1\r\nX\r\n"), nil
++ }
++ return []byte("0\r\n"), nil
++ }})
++ got, err := io.ReadAll(r)
++ if err != nil {
++ t.Errorf("unexpected error: %v", err)
++ }
++ if len(got) != bodylen {
++ t.Errorf("read %v bytes, want %v", len(got), bodylen)
++ }
++}
++
++type funcReader struct {
++ f func(iteration int) ([]byte, error)
++ i int
++ b []byte
++ err error
++}
++
++func (r *funcReader) Read(p []byte) (n int, err error) {
++ if len(r.b) == 0 && r.err == nil {
++ r.b, r.err = r.f(r.i)
++ r.i++
++ }
++ n = copy(p, r.b)
++ r.b = r.b[n:]
++ if len(r.b) > 0 {
++ return n, nil
++ }
++ return n, r.err
++}
+--
+2.40.0
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 07/11] openssh: backport Debian patch for CVE-2023-48795
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (5 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 06/11] go: Fix CVE-2023-39326 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 08/11] perl: update 5.34.1 -> 5.34.3 Steve Sakoman
` (3 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
import patches from ubuntu to fix
fix-authorized-principals-command
CVE-2023-48795
Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches?h=ubuntu/jammy-security
Upstream commit
https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290
&
https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5]
Reference: https://ubuntu.com/security/CVE-2023-48795
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../openssh/openssh/CVE-2023-48795.patch | 476 ++++++++++++++++++
.../fix-authorized-principals-command.patch | 30 ++
.../openssh/openssh_8.9p1.bb | 2 +
3 files changed, 508 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch
new file mode 100644
index 0000000000..6b2f927779
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch
@@ -0,0 +1,476 @@
+(modified to not remove ssh_packet_read_expect() and to add to
+KexAlgorithms in sshd.c and sshconnect2.c as this version pre-dates
+kex_proposal_populate_entries())
+
+Backport of:
+
+From 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 18 Dec 2023 14:45:17 +0000
+Subject: [PATCH] upstream: implement "strict key exchange" in ssh and sshd
+
+This adds a protocol extension to improve the integrity of the SSH
+transport protocol, particular in and around the initial key exchange
+(KEX) phase.
+
+Full details of the extension are in the PROTOCOL file.
+
+with markus@
+
+OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14
+
+Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches/CVE-2023-48795.patch?h=ubuntu/jammy-security
+Upstream commit https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5]
+CVE: CVE-2023-48795
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ PROTOCOL | 26 +++++++++++++++++
+ kex.c | 72 +++++++++++++++++++++++++++++++----------------
+ kex.h | 1 +
+ packet.c | 78 ++++++++++++++++++++++++++++++++++++++-------------
+ sshconnect2.c | 14 +++------
+ sshd.c | 7 +++--
+ 6 files changed, 142 insertions(+), 56 deletions(-)
+
+diff --git a/PROTOCOL b/PROTOCOL
+index e6a7d60..971f01e 100644
+--- a/PROTOCOL
++++ b/PROTOCOL
+@@ -102,6 +102,32 @@ OpenSSH supports the use of ECDH in Curve25519 for key exchange as
+ described at:
+ http://git.libssh.org/users/aris/libssh.git/plain/doc/curve25519-sha256@libssh.org.txt?h=curve25519
+
++1.9 transport: strict key exchange extension
++
++OpenSSH supports a number of transport-layer hardening measures under
++a "strict KEX" feature. This feature is signalled similarly to the
++RFC8308 ext-info feature: by including a additional algorithm in the
++initiial SSH2_MSG_KEXINIT kex_algorithms field. The client may append
++"kex-strict-c-v00@openssh.com" to its kex_algorithms and the server
++may append "kex-strict-s-v00@openssh.com". These pseudo-algorithms
++are only valid in the initial SSH2_MSG_KEXINIT and MUST be ignored
++if they are present in subsequent SSH2_MSG_KEXINIT packets.
++
++When an endpoint that supports this extension observes this algorithm
++name in a peer's KEXINIT packet, it MUST make the following changes to
++the the protocol:
++
++a) During initial KEX, terminate the connection if any unexpected or
++ out-of-sequence packet is received. This includes terminating the
++ connection if the first packet received is not SSH2_MSG_KEXINIT.
++ Unexpected packets for the purpose of strict KEX include messages
++ that are otherwise valid at any time during the connection such as
++ SSH2_MSG_DEBUG and SSH2_MSG_IGNORE.
++b) After sending or receiving a SSH2_MSG_NEWKEYS message, reset the
++ packet sequence number to zero. This behaviour persists for the
++ duration of the connection (i.e. not just the first
++ SSH2_MSG_NEWKEYS).
++
+ 2. Connection protocol changes
+
+ 2.1. connection: Channel write close extension "eow@openssh.com"
+diff --git a/kex.c b/kex.c
+index 0bcd27d..e7b2d4d 100644
+--- a/kex.c
++++ b/kex.c
+@@ -63,7 +63,7 @@
+ #include "digest.h"
+
+ /* prototype */
+-static int kex_choose_conf(struct ssh *);
++static int kex_choose_conf(struct ssh *, uint32_t seq);
+ static int kex_input_newkeys(int, u_int32_t, struct ssh *);
+
+ static const char * const proposal_names[PROPOSAL_MAX] = {
+@@ -175,6 +175,18 @@ kex_names_valid(const char *names)
+ return 1;
+ }
+
++/* returns non-zero if proposal contains any algorithm from algs */
++static int
++has_any_alg(const char *proposal, const char *algs)
++{
++ char *cp;
++
++ if ((cp = match_list(proposal, algs, NULL)) == NULL)
++ return 0;
++ free(cp);
++ return 1;
++}
++
+ /*
+ * Concatenate algorithm names, avoiding duplicates in the process.
+ * Caller must free returned string.
+@@ -182,7 +194,7 @@ kex_names_valid(const char *names)
+ char *
+ kex_names_cat(const char *a, const char *b)
+ {
+- char *ret = NULL, *tmp = NULL, *cp, *p, *m;
++ char *ret = NULL, *tmp = NULL, *cp, *p;
+ size_t len;
+
+ if (a == NULL || *a == '\0')
+@@ -199,10 +211,8 @@ kex_names_cat(const char *a, const char *b)
+ }
+ strlcpy(ret, a, len);
+ for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) {
+- if ((m = match_list(ret, p, NULL)) != NULL) {
+- free(m);
++ if (has_any_alg(ret, p))
+ continue; /* Algorithm already present */
+- }
+ if (strlcat(ret, ",", len) >= len ||
+ strlcat(ret, p, len) >= len) {
+ free(tmp);
+@@ -410,7 +420,12 @@ kex_protocol_error(int type, u_int32_t seq, struct ssh *ssh)
+ {
+ int r;
+
+- error("kex protocol error: type %d seq %u", type, seq);
++ /* If in strict mode, any unexpected message is an error */
++ if ((ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) {
++ ssh_packet_disconnect(ssh, "strict KEX violation: "
++ "unexpected packet type %u (seqnr %u)", type, seq);
++ }
++ error_f("type %u seq %u", type, seq);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
+ (r = sshpkt_put_u32(ssh, seq)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+@@ -485,6 +500,11 @@ kex_input_ext_info(int type, u_int32_t seq, struct ssh *ssh)
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error);
+ if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0)
+ return r;
++ if (ninfo >= 1024) {
++ error("SSH2_MSG_EXT_INFO with too many entries, expected "
++ "<=1024, received %u", ninfo);
++ return dispatch_protocol_error(type, seq, ssh);
++ }
+ for (i = 0; i < ninfo; i++) {
+ if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0)
+ return r;
+@@ -600,7 +620,7 @@ kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh)
+ error_f("no kex");
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+- ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_protocol_error);
+ ptr = sshpkt_ptr(ssh, &dlen);
+ if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
+ return r;
+@@ -636,7 +656,7 @@ kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh)
+ if (!(kex->flags & KEX_INIT_SENT))
+ if ((r = kex_send_kexinit(ssh)) != 0)
+ return r;
+- if ((r = kex_choose_conf(ssh)) != 0)
++ if ((r = kex_choose_conf(ssh, seq)) != 0)
+ return r;
+
+ if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL)
+@@ -900,20 +920,14 @@ proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
+ return (1);
+ }
+
+-/* returns non-zero if proposal contains any algorithm from algs */
+ static int
+-has_any_alg(const char *proposal, const char *algs)
++kexalgs_contains(char **peer, const char *ext)
+ {
+- char *cp;
+-
+- if ((cp = match_list(proposal, algs, NULL)) == NULL)
+- return 0;
+- free(cp);
+- return 1;
++ return has_any_alg(peer[PROPOSAL_KEX_ALGS], ext);
+ }
+
+ static int
+-kex_choose_conf(struct ssh *ssh)
++kex_choose_conf(struct ssh *ssh, uint32_t seq)
+ {
+ struct kex *kex = ssh->kex;
+ struct newkeys *newkeys;
+@@ -938,13 +952,23 @@ kex_choose_conf(struct ssh *ssh)
+ sprop=peer;
+ }
+
+- /* Check whether client supports ext_info_c */
+- if (kex->server && (kex->flags & KEX_INITIAL)) {
+- char *ext;
+-
+- ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL);
+- kex->ext_info_c = (ext != NULL);
+- free(ext);
++ /* Check whether peer supports ext_info/kex_strict */
++ if ((kex->flags & KEX_INITIAL) != 0) {
++ if (kex->server) {
++ kex->ext_info_c = kexalgs_contains(peer, "ext-info-c");
++ kex->kex_strict = kexalgs_contains(peer,
++ "kex-strict-c-v00@openssh.com");
++ } else {
++ kex->kex_strict = kexalgs_contains(peer,
++ "kex-strict-s-v00@openssh.com");
++ }
++ if (kex->kex_strict) {
++ debug3_f("will use strict KEX ordering");
++ if (seq != 0)
++ ssh_packet_disconnect(ssh,
++ "strict KEX violation: "
++ "KEXINIT was not the first packet");
++ }
+ }
+
+ /* Check whether client supports rsa-sha2 algorithms */
+diff --git a/kex.h b/kex.h
+index c353295..d97323e 100644
+--- a/kex.h
++++ b/kex.h
+@@ -148,6 +148,7 @@ struct kex {
+ u_int kex_type;
+ char *server_sig_algs;
+ int ext_info_c;
++ int kex_strict;
+ struct sshbuf *my;
+ struct sshbuf *peer;
+ struct sshbuf *client_version;
+diff --git a/packet.c b/packet.c
+index bde6c10..28f3729 100644
+--- a/packet.c
++++ b/packet.c
+@@ -1205,8 +1205,13 @@ ssh_packet_send2_wrapped(struct ssh *ssh)
+ sshbuf_dump(state->output, stderr);
+ #endif
+ /* increment sequence number for outgoing packets */
+- if (++state->p_send.seqnr == 0)
++ if (++state->p_send.seqnr == 0) {
++ if ((ssh->kex->flags & KEX_INITIAL) != 0) {
++ ssh_packet_disconnect(ssh, "outgoing sequence number "
++ "wrapped during initial key exchange");
++ }
+ logit("outgoing seqnr wraps around");
++ }
+ if (++state->p_send.packets == 0)
+ if (!(ssh->compat & SSH_BUG_NOREKEY))
+ return SSH_ERR_NEED_REKEY;
+@@ -1214,6 +1219,11 @@ ssh_packet_send2_wrapped(struct ssh *ssh)
+ state->p_send.bytes += len;
+ sshbuf_reset(state->outgoing_packet);
+
++ if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
++ debug_f("resetting send seqnr %u", state->p_send.seqnr);
++ state->p_send.seqnr = 0;
++ }
++
+ if (type == SSH2_MSG_NEWKEYS)
+ r = ssh_set_newkeys(ssh, MODE_OUT);
+ else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
+@@ -1342,8 +1352,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ /* Stay in the loop until we have received a complete packet. */
+ for (;;) {
+ /* Try to read a packet from the buffer. */
+- r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p);
+- if (r != 0)
++ if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0)
+ break;
+ /* If we got a packet, return it. */
+ if (*typep != SSH_MSG_NONE)
+@@ -1627,10 +1636,16 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
+ goto out;
+ }
++
+ if (seqnr_p != NULL)
+ *seqnr_p = state->p_read.seqnr;
+- if (++state->p_read.seqnr == 0)
++ if (++state->p_read.seqnr == 0) {
++ if ((ssh->kex->flags & KEX_INITIAL) != 0) {
++ ssh_packet_disconnect(ssh, "incoming sequence number "
++ "wrapped during initial key exchange");
++ }
+ logit("incoming seqnr wraps around");
++ }
+ if (++state->p_read.packets == 0)
+ if (!(ssh->compat & SSH_BUG_NOREKEY))
+ return SSH_ERR_NEED_REKEY;
+@@ -1696,6 +1711,10 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ #endif
+ /* reset for next packet */
+ state->packlen = 0;
++ if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
++ debug_f("resetting read seqnr %u", state->p_read.seqnr);
++ state->p_read.seqnr = 0;
++ }
+
+ if ((r = ssh_packet_check_rekey(ssh)) != 0)
+ return r;
+@@ -1716,10 +1735,39 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
+ if (r != 0)
+ return r;
+- if (*typep) {
+- state->keep_alive_timeouts = 0;
+- DBG(debug("received packet type %d", *typep));
++ if (*typep == 0) {
++ /* no message ready */
++ return 0;
++ }
++ state->keep_alive_timeouts = 0;
++ DBG(debug("received packet type %d", *typep));
++
++ /* Always process disconnect messages */
++ if (*typep == SSH2_MSG_DISCONNECT) {
++ if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
++ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
++ return r;
++ /* Ignore normal client exit notifications */
++ do_log2(ssh->state->server_side &&
++ reason == SSH2_DISCONNECT_BY_APPLICATION ?
++ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
++ "Received disconnect from %s port %d:"
++ "%u: %.400s", ssh_remote_ipaddr(ssh),
++ ssh_remote_port(ssh), reason, msg);
++ free(msg);
++ return SSH_ERR_DISCONNECTED;
+ }
++
++ /*
++ * Do not implicitly handle any messages here during initial
++ * KEX when in strict mode. They will be need to be allowed
++ * explicitly by the KEX dispatch table or they will generate
++ * protocol errors.
++ */
++ if (ssh->kex != NULL &&
++ (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict)
++ return 0;
++ /* Implicitly handle transport-level messages */
+ switch (*typep) {
+ case SSH2_MSG_IGNORE:
+ debug3("Received SSH2_MSG_IGNORE");
+@@ -1734,19 +1782,6 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ debug("Remote: %.900s", msg);
+ free(msg);
+ break;
+- case SSH2_MSG_DISCONNECT:
+- if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
+- (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
+- return r;
+- /* Ignore normal client exit notifications */
+- do_log2(ssh->state->server_side &&
+- reason == SSH2_DISCONNECT_BY_APPLICATION ?
+- SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
+- "Received disconnect from %s port %d:"
+- "%u: %.400s", ssh_remote_ipaddr(ssh),
+- ssh_remote_port(ssh), reason, msg);
+- free(msg);
+- return SSH_ERR_DISCONNECTED;
+ case SSH2_MSG_UNIMPLEMENTED:
+ if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
+ return r;
+@@ -2211,6 +2246,7 @@ kex_to_blob(struct sshbuf *m, struct kex *kex)
+ (r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
++ (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 ||
+ (r = sshbuf_put_stringb(m, kex->my)) != 0 ||
+ (r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
+ (r = sshbuf_put_stringb(m, kex->client_version)) != 0 ||
+@@ -2373,6 +2409,7 @@ kex_from_blob(struct sshbuf *m, struct kex **kexp)
+ (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
+ (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 ||
+ (r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
++ (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 ||
+ (r = sshbuf_get_stringb(m, kex->my)) != 0 ||
+ (r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
+ (r = sshbuf_get_stringb(m, kex->client_version)) != 0 ||
+@@ -2701,6 +2738,7 @@ sshpkt_disconnect(struct ssh *ssh, const char *fmt,...)
+ vsnprintf(buf, sizeof(buf), fmt, args);
+ va_end(args);
+
++ debug2_f("sending SSH2_MSG_DISCONNECT: %s", buf);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
+ (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
+diff --git a/sshconnect2.c b/sshconnect2.c
+index b25225e..83ae4a4 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -241,7 +241,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+ fatal_fr(r, "kex_assemble_namelist");
+ free(all_key);
+
+- if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
++ if ((s = kex_names_cat(options.kex_algorithms,
++ "ext-info-c,kex-strict-c-v00@openssh.com")) == NULL)
+ fatal_f("kex_names_cat");
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s);
+ myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+@@ -363,7 +364,6 @@ struct cauthmethod {
+ };
+
+ static int input_userauth_service_accept(int, u_int32_t, struct ssh *);
+-static int input_userauth_ext_info(int, u_int32_t, struct ssh *);
+ static int input_userauth_success(int, u_int32_t, struct ssh *);
+ static int input_userauth_failure(int, u_int32_t, struct ssh *);
+ static int input_userauth_banner(int, u_int32_t, struct ssh *);
+@@ -477,7 +477,7 @@ ssh_userauth2(struct ssh *ssh, const char *local_user,
+
+ ssh->authctxt = &authctxt;
+ ssh_dispatch_init(ssh, &input_userauth_error);
+- ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info);
++ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, kex_input_ext_info);
+ ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept);
+ ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &authctxt.success); /* loop until success */
+ pubkey_cleanup(ssh);
+@@ -529,13 +529,6 @@ input_userauth_service_accept(int type, u_int32_t seq, struct ssh *ssh)
+ return r;
+ }
+
+-/* ARGSUSED */
+-static int
+-input_userauth_ext_info(int type, u_int32_t seqnr, struct ssh *ssh)
+-{
+- return kex_input_ext_info(type, seqnr, ssh);
+-}
+-
+ void
+ userauth(struct ssh *ssh, char *authlist)
+ {
+@@ -617,6 +610,7 @@ input_userauth_success(int type, u_int32_t seq, struct ssh *ssh)
+ free(authctxt->methoddata);
+ authctxt->methoddata = NULL;
+ authctxt->success = 1; /* break out */
++ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, dispatch_protocol_error);
+ return 0;
+ }
+
+diff --git a/sshd.c b/sshd.c
+index ef18ba4..652bdc3 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -2354,11 +2354,13 @@ static void
+ do_ssh2_kex(struct ssh *ssh)
+ {
+ char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
++ char *s;
+ struct kex *kex;
+ int r;
+
+- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh,
+- options.kex_algorithms);
++ if ((s = kex_names_cat(options.kex_algorithms, "kex-strict-s-v00@openssh.com")) == NULL)
++ fatal_f("kex_names_cat");
++ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s);
+ myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh,
+ options.ciphers);
+ myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh,
+@@ -2411,6 +2413,7 @@ do_ssh2_kex(struct ssh *ssh)
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ fatal_fr(r, "send test");
+ #endif
++ free(s);
+ debug("KEX done");
+ }
+
+--
+2.25.1
+
diff --git a/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch b/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch
new file mode 100644
index 0000000000..3790774f15
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch
@@ -0,0 +1,30 @@
+From fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 24 May 2023 23:01:06 +0000
+Subject: [PATCH] upstream: fix AuthorizedPrincipalsCommand when
+ AuthorizedKeysCommand
+Description: Fix the wrong code as the Subject suggests
+ I added that description to mention, that the file header change was
+ incompatible with the proposed code below and failed to apply,
+ therefore I dropped that chunk of the code.
+Origin: backport, https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3574
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2031942
+Last-Update: 2023-09-01
+
+Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches/fix-authorized-principals-command.patch?h=ubuntu/jammy-security
+Upstream commit https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290]
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/servconf.c
++++ b/servconf.c
+@@ -2372,7 +2372,7 @@ process_server_config_line_depth(ServerO
+ fatal("%.200s line %d: %s must be an absolute path",
+ filename, linenum, keyword);
+ }
+- if (*activep && options->authorized_keys_command == NULL)
++ if (*activep && *charptr == NULL)
+ *charptr = xstrdup(str + len);
+ argv_consume(&ac);
+ break;
diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
index 32761b8bb8..7ad9bced1b 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
@@ -32,6 +32,8 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2023-38408-0002.patch \
file://CVE-2023-38408-0003.patch \
file://CVE-2023-38408-0004.patch \
+ file://fix-authorized-principals-command.patch \
+ file://CVE-2023-48795.patch \
"
SRC_URI[sha256sum] = "fd497654b7ab1686dac672fb83dfb4ba4096e8b5ffcdaccd262380ae58bec5e7"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 08/11] perl: update 5.34.1 -> 5.34.3
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (6 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 07/11] openssh: backport Debian patch for CVE-2023-48795 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 09/11] externalsrc: Ensure SRCREV is processed before accessing SRC_URI Steve Sakoman
` (2 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Soumya Sambu <soumya.sambu@windriver.com>
This includes security fix for CVE-2023-47038
Changes:
https://metacpan.org/release/PEVANS/perl-5.34.3/changes
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../0001-Makefile-check-the-file-if-patched-or-not.patch | 4 ++--
.../perl-cross/{perlcross_1.3.7.bb => perlcross_1.5.2.bb} | 2 +-
meta/recipes-devtools/perl/{perl_5.34.1.bb => perl_5.34.3.bb} | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
rename meta/recipes-devtools/perl-cross/{perlcross_1.3.7.bb => perlcross_1.5.2.bb} (92%)
rename meta/recipes-devtools/perl/{perl_5.34.1.bb => perl_5.34.3.bb} (99%)
diff --git a/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch b/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch
index 8c8f3b717c..0ef9b27439 100644
--- a/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch
+++ b/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch
@@ -21,8 +21,8 @@ index f4a26f5..7bc748e 100644
# Original versions are not saved anymore; patch generally takes care of this,
# and if that fails, reaching for the source tarball is the safest option.
$(CROSSPATCHED): %.applied: %.patch
-- patch -p1 -i $< && touch $@
-+ test ! -f $@ && (patch -p1 -i $< && touch $@) || echo "$@ exist"
+- $(cpatch) -p1 -i $< && touch $@
++ test ! -f $@ && ($(cpatch) -p1 -i $< && touch $@) || echo "$@ exist"
# ---[ common ]-----------------------------------------------------------------
diff --git a/meta/recipes-devtools/perl-cross/perlcross_1.3.7.bb b/meta/recipes-devtools/perl-cross/perlcross_1.5.2.bb
similarity index 92%
rename from meta/recipes-devtools/perl-cross/perlcross_1.3.7.bb
rename to meta/recipes-devtools/perl-cross/perlcross_1.5.2.bb
index 99a9ca1027..ac4dff33bb 100644
--- a/meta/recipes-devtools/perl-cross/perlcross_1.3.7.bb
+++ b/meta/recipes-devtools/perl-cross/perlcross_1.5.2.bb
@@ -18,7 +18,7 @@ SRC_URI = "https://github.com/arsv/perl-cross/releases/download/${PV}/perl-cross
"
UPSTREAM_CHECK_URI = "https://github.com/arsv/perl-cross/releases/"
-SRC_URI[perl-cross.sha256sum] = "77f13ca84a63025053852331b72d4046c1f90ded98bd45ccedea738621907335"
+SRC_URI[perl-cross.sha256sum] = "584dc54c48dca25e032b676a15bef377c1fed9de318b4fc140292a5dbf326e90"
S = "${WORKDIR}/perl-cross-${PV}"
diff --git a/meta/recipes-devtools/perl/perl_5.34.1.bb b/meta/recipes-devtools/perl/perl_5.34.3.bb
similarity index 99%
rename from meta/recipes-devtools/perl/perl_5.34.1.bb
rename to meta/recipes-devtools/perl/perl_5.34.3.bb
index db306d0be3..e8b518adc9 100644
--- a/meta/recipes-devtools/perl/perl_5.34.1.bb
+++ b/meta/recipes-devtools/perl/perl_5.34.3.bb
@@ -29,7 +29,7 @@ SRC_URI:append:class-target = " \
file://encodefix.patch \
"
-SRC_URI[perl.sha256sum] = "357951a491b0ba1ce3611263922feec78ccd581dddc24a446b033e25acf242a1"
+SRC_URI[perl.sha256sum] = "5b12f62863332b2a5f54102af9cdf8c010877e4bf3294911edbd594b2a1e8ede"
S = "${WORKDIR}/perl-${PV}"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 09/11] externalsrc: Ensure SRCREV is processed before accessing SRC_URI
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (7 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 08/11] perl: update 5.34.1 -> 5.34.3 Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 10/11] python3-ptest: skip test_storlines Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 11/11] testimage: Exclude wtmp from target-dumper commands Steve Sakoman
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Yoann Congal <yoann.congal@smile.fr>
When SRCREV is used, call bb.fetch.get_srcrev() before accessing
SRC_URI. Without this new bb.fetch.get_srcrev() call, SRC_URI might be
accessed before SRCREV had a chance to be processed.
In master, this is fixed by https://git.yoctoproject.org/poky/commit/?id=62afa02d01794376efab75623f42e7e08af08526
However, this commit is not suited for backport since it is quite invasive.
The part of the commit that fix the bug is:
--- a/meta/classes/externalsrc.bbclass
+++ b/meta/classes/externalsrc.bbclass
@@ -63,6 +63,7 @@ python () {
else:
d.setVar('B', '${WORKDIR}/${BPN}-${PV}')
+ bb.fetch.get_hashvalue(d)
local_srcuri = []
fetch = bb.fetch2.Fetch((d.getVar('SRC_URI') or '').split(), d)
for url in fetch.urls:
NB: bb.fetch.get_hashvalue() does not exist in kirkstone but is
equivalent to bb.fetch.get_srcrev().
Fixes [YOCTO #14918]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Suggested-by: Chris Wyse <chris.wyse@wysechoice.net>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/externalsrc.bbclass | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/classes/externalsrc.bbclass b/meta/classes/externalsrc.bbclass
index 97d7379d9f..a209730240 100644
--- a/meta/classes/externalsrc.bbclass
+++ b/meta/classes/externalsrc.bbclass
@@ -62,6 +62,10 @@ python () {
else:
d.setVar('B', '${WORKDIR}/${BPN}-${PV}')
+ if d.getVar('SRCREV', "INVALID") != "INVALID":
+ # Ensure SRCREV has been processed before accessing SRC_URI
+ bb.fetch.get_srcrev(d)
+
local_srcuri = []
fetch = bb.fetch2.Fetch((d.getVar('SRC_URI') or '').split(), d)
for url in fetch.urls:
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 10/11] python3-ptest: skip test_storlines
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (8 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 09/11] externalsrc: Ensure SRCREV is processed before accessing SRC_URI Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 11/11] testimage: Exclude wtmp from target-dumper commands Steve Sakoman
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Trevor Gamblin <tgamblin@baylibre.com>
[YOCTO #14933]
test_storlines is yet another Python ptest that fails intermittently on
the Yocto AB, so disable it during ptests for now.
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit d7b9f8157e6214a83b5495e8a32e11540ae65ff8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...orlines-skip-due-to-load-variability.patch | 32 +++++++++++++++++++
.../python/python3_3.10.13.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch
diff --git a/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch b/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch
new file mode 100644
index 0000000000..199031d42a
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch
@@ -0,0 +1,32 @@
+From 013ff01fdf2aa6ca69a7c80a2a2996630877e4ea Mon Sep 17 00:00:00 2001
+From: Trevor Gamblin <tgamblin@baylibre.com>
+Date: Fri, 6 Oct 2023 10:59:44 -0400
+Subject: [PATCH] test_storlines: skip due to load variability
+
+This is yet another test that intermittently fails on the Yocto AB when
+a worker is under heavy load, so skip it during testing.
+
+Upstream-Status: Inappropriate [OE-Specific]
+
+[YOCTO #14933]
+
+Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
+---
+ Lib/test/test_ftplib.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py
+index 082a90d46b..508814d56a 100644
+--- a/Lib/test/test_ftplib.py
++++ b/Lib/test/test_ftplib.py
+@@ -629,6 +629,7 @@ def test_storbinary_rest(self):
+ self.client.storbinary('stor', f, rest=r)
+ self.assertEqual(self.server.handler_instance.rest, str(r))
+
++ @unittest.skip('timing related test, dependent on load')
+ def test_storlines(self):
+ data = RETR_DATA.replace('\r\n', '\n').encode(self.client.encoding)
+ f = io.BytesIO(data)
+--
+2.41.0
+
diff --git a/meta/recipes-devtools/python/python3_3.10.13.bb b/meta/recipes-devtools/python/python3_3.10.13.bb
index ba53a09ef5..76e37e42a1 100644
--- a/meta/recipes-devtools/python/python3_3.10.13.bb
+++ b/meta/recipes-devtools/python/python3_3.10.13.bb
@@ -35,6 +35,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch \
file://deterministic_imports.patch \
file://0001-Avoid-shebang-overflow-on-python-config.py.patch \
+ file://0001-test_storlines-skip-due-to-load-variability.patch \
"
SRC_URI:append:class-native = " \
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 11/11] testimage: Exclude wtmp from target-dumper commands
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
` (9 preceding siblings ...)
2023-12-21 2:09 ` [OE-core][kirkstone 10/11] python3-ptest: skip test_storlines Steve Sakoman
@ 2023-12-21 2:09 ` Steve Sakoman
10 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-12-21 2:09 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
wtmp is filled with binary data which the run_serial command can't cope with.
Catting this results in confusion of the serial interface and potentially large
backlogs of data in the buffers which can hang qemu.
Exclude the problematic files from the command.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 599ac08a6f6fb3f6a89a897c8e06367c63c2f979)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/testimage.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/testimage.bbclass b/meta/classes/testimage.bbclass
index 34173ce68d..6864eeed2f 100644
--- a/meta/classes/testimage.bbclass
+++ b/meta/classes/testimage.bbclass
@@ -112,7 +112,7 @@ testimage_dump_target () {
netstat -an
ip address
# Next command will dump logs from /var/log/
- find /var/log/ -type f 2>/dev/null -exec echo "====================" \; -exec echo {} \; -exec echo "====================" \; -exec cat {} \; -exec echo "" \;
+ find /var/log/ -type f -name !wtmp* 2>/dev/null -exec echo "====================" \; -exec echo {} \; -exec echo "====================" \; -exec cat {} \; -exec echo "" \;
}
testimage_dump_host () {
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2024-03-04 15:23 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2024-03-04 15:23 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, March 6
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6640
The following changes since commit cca0971a7d92d823cc0c2b16cf14a7b2ed8ecb61:
kernel: make LOCALVERSION consistent between recipes (2024-02-27 03:51:58 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Sverdlin (1):
linux-firmware: upgrade 20231030 -> 20231211
Dhairya Nagodra (1):
dbus: Add missing CVE_PRODUCT
Munehisa Kamata (1):
kernel.bbclass: Set pkg-config variables for building modules
Peter Marko (1):
glibc: ignore CVE-2023-0687
Poonam Jadhav (1):
qemu: Fix CVE-2023-42467
Priyal Doshi (1):
tzdata : Upgrade to 2024a
Ross Burton (1):
cve_check: cleanup logging
Soumya Sambu (1):
bind: Upgrade 9.18.19 -> 9.18.24
Vijay Anusuri (2):
less: Fix for CVE-2022-48624
qemu: Fix for CVE-2024-24474
Vivek Kumbhar (1):
qemu: Backport fix CVE-2023-6693
meta/classes/kernel.bbclass | 7 ++
meta/lib/oe/cve_check.py | 13 ++--
.../bind/{bind_9.18.19.bb => bind_9.18.24.bb} | 2 +-
meta/recipes-core/dbus/dbus_1.14.8.bb | 2 +-
meta/recipes-core/glibc/glibc_2.35.bb | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 5 ++
.../qemu/qemu/CVE-2023-42467.patch | 46 ++++++++++++
.../qemu/qemu/CVE-2023-6693.patch | 74 +++++++++++++++++++
.../qemu/qemu/CVE-2024-24474.patch | 44 +++++++++++
...lock-desriptor-to-set-the-block-size.patch | 54 ++++++++++++++
...ero-and-changes-limited-to-bits-8-15.patch | 67 +++++++++++++++++
.../less/less/CVE-2022-48624.patch | 41 ++++++++++
meta/recipes-extended/less/less_600.bb | 1 +
meta/recipes-extended/timezone/timezone.inc | 6 +-
...20231030.bb => linux-firmware_20231211.bb} | 7 +-
15 files changed, 355 insertions(+), 16 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.19.bb => bind_9.18.24.bb} (97%)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-6693.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-24474.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/scsi-disk-allow-MODE-SELECT-block-desriptor-to-set-the-block-size.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/scsi-disk-ensure-block-size-is-non-zero-and-changes-limited-to-bits-8-15.patch
create mode 100644 meta/recipes-extended/less/less/CVE-2022-48624.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20231030.bb => linux-firmware_20231211.bb} (99%)
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2024-08-13 12:16 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2024-08-13 12:16 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, August 15
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7236
The following changes since commit 2721f84ba755ceea5780e44feb0713ad8c4d0217:
lttng-modules: Upgrade 2.13.9 -> 2.13.14 (2024-08-02 12:10:02 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (4):
ghostscript: fix CVE-2024-29511
ghostscript: fix CVE-2024-29509
ghostscript: fix CVE-2024-29506
go: fix CVE-2024-24791
Hitendra Prajapati (1):
busybox: CVE-2023-42364, CVE-2023-42365, CVE-2023-42366 fixes
Peter Marko (1):
libyaml: Update status of CVE-2024-35328
Richard Purdie (1):
cve_check: Use a local copy of the database during builds
Ross Burton (1):
python3-pycryptodome(x): use python_setuptools_build_meta build class
Soumya Sambu (1):
python3-certifi: Fix CVE-2024-39689
Vijay Anusuri (1):
orc: upgrade 0.4.32 -> 0.4.39
Yogita Urade (1):
ofono: fix CVE-2023-2794
meta/classes/cve-check.bbclass | 7 +-
.../ofono/ofono/CVE-2023-2794-0001.patch | 37 ++
.../ofono/ofono/CVE-2023-2794-0002.patch | 32 ++
.../ofono/ofono/CVE-2023-2794-0003.patch | 44 +++
.../ofono/ofono/CVE-2023-2794-0004.patch | 127 +++++++
meta/recipes-connectivity/ofono/ofono_1.34.bb | 4 +
.../busybox/CVE-2023-42364_42365-1.patch | 197 ++++++++++
.../busybox/CVE-2023-42364_42365-2.patch | 96 +++++
.../busybox/busybox/CVE-2023-42366.patch | 36 ++
meta/recipes-core/busybox/busybox_1.35.0.bb | 3 +
.../meta/cve-update-nvd2-native.bb | 18 +-
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.21/CVE-2024-24791.patch | 359 ++++++++++++++++++
.../orc/{orc_0.4.32.bb => orc_0.4.39.bb} | 2 +-
.../python3-certifi/CVE-2024-39689.patch | 69 ++++
.../python/python3-certifi_2021.10.8.bb | 1 +
.../python/python3-pycryptodome_3.14.1.bb | 2 +-
.../python/python3-pycryptodomex_3.14.1.bb | 2 +-
.../ghostscript/CVE-2024-29506.patch | 45 +++
.../ghostscript/CVE-2024-29509.patch | 45 +++
.../ghostscript/CVE-2024-29511-0001.patch | 100 +++++
.../ghostscript/CVE-2024-29511-0002.patch | 219 +++++++++++
.../ghostscript/ghostscript_9.55.0.bb | 4 +
meta/recipes-support/libyaml/libyaml_0.2.5.bb | 3 +
24 files changed, 1442 insertions(+), 11 deletions(-)
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-2794-0001.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-2794-0002.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-2794-0003.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-2794-0004.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-42364_42365-1.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-42364_42365-2.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-42366.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2024-24791.patch
rename meta/recipes-devtools/orc/{orc_0.4.32.bb => orc_0.4.39.bb} (92%)
create mode 100644 meta/recipes-devtools/python/python3-certifi/CVE-2024-39689.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2024-29506.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2024-29509.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2024-29511-0001.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2024-29511-0002.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2025-01-15 14:37 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2025-01-15 14:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, January 17
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/809
The following changes since commit a270d4c957259761bcc7382fcc54642a02f9fc7d:
build-appliance-image: Update to kirkstone head revision (2025-01-09 08:49:38 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (3):
go: Fix CVE-2024-34155
go: Fix CVE-2024-34156
go: Fix CVE-2024-34158
Divya Chellam (1):
ruby: fix CVE-2024-49761
Peter Marko (1):
gstreamer1.0: ignore CVEs fixed in plugins recipes
Yogita Urade (6):
ofono: fix CVE-2024-7539
ofono: fix CVE-2024-7543
ofono: fix CVE-2024-7544
ofono: fix CVE-2024-7545
ofono: fix CVE-2024-7546
ofono: fix CVE-2024-7547
.../ofono/ofono/CVE-2024-7539.patch | 88 +++
.../ofono/ofono/CVE-2024-7543.patch | 30 +
.../ofono/ofono/CVE-2024-7544.patch | 30 +
.../ofono/ofono/CVE-2024-7545.patch | 32 +
.../ofono/ofono/CVE-2024-7546.patch | 30 +
.../ofono/ofono/CVE-2024-7547.patch | 29 +
meta/recipes-connectivity/ofono/ofono_1.34.bb | 6 +
meta/recipes-devtools/go/go-1.17.13.inc | 3 +
.../go/go-1.21/CVE-2024-34155.patch | 71 +++
.../go/go-1.21/CVE-2024-34156.patch | 150 +++++
.../go/go-1.21/CVE-2024-34158.patch | 205 +++++++
.../ruby/ruby/CVE-2024-49761-0001.patch | 391 ++++++++++++
.../ruby/ruby/CVE-2024-49761-0002.patch | 104 ++++
.../ruby/ruby/CVE-2024-49761-0003.patch | 85 +++
.../ruby/ruby/CVE-2024-49761-0004.patch | 71 +++
.../ruby/ruby/CVE-2024-49761-0005.patch | 51 ++
.../ruby/ruby/CVE-2024-49761-0006.patch | 79 +++
.../ruby/ruby/CVE-2024-49761-0007.patch | 561 ++++++++++++++++++
.../ruby/ruby/CVE-2024-49761-0008.patch | 107 ++++
.../ruby/ruby/CVE-2024-49761-0009.patch | 46 ++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 9 +
.../gstreamer/gstreamer1.0_1.20.7.bb | 9 +
22 files changed, 2187 insertions(+)
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7539.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7543.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7544.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7545.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7546.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7547.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2024-34155.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2024-34156.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2024-34158.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0001.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0002.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0003.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0004.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0005.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0006.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0007.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0008.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-49761-0009.patch
--
2.43.0
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][kirkstone 00/11] Patch review
@ 2025-07-09 15:19 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2025-07-09 15:19 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments bach by
end of day Friday, July 11
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1983
The following changes since commit 78055e8b6a9ea5063658886c5b5d22821d689fc5:
xwayland: fix CVE-2025-49180 (2025-07-05 06:12:53 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Bruce Ashfield (1):
linux-yocto/5.15: update to v5.15.186
Changqing Li (3):
libsoup-2.4: refresh CVE-2025-4969.patch
libsoup-2.4: fix CVE-2025-4945
libsoup: fix CVE-2025-4945
Chen Qi (1):
coreutils: fix CVE-2025-5278
Divya Chellam (3):
libarchive: fix CVE-2025-5915
libarchive: fix CVE-2025-5916
libarchive: fix CVE-2025-5917
Hitendra Prajapati (1):
libxml2: fix CVE-2025-6021
Yogita Urade (2):
curl: fix CVE-2024-11053
curl: fix CVE-2025-0167
.../coreutils/coreutils/CVE-2025-5278.patch | 113 +++
meta/recipes-core/coreutils/coreutils_9.0.bb | 1 +
.../libxml/libxml2/CVE-2025-6021.patch | 56 ++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
.../libarchive/libarchive/CVE-2025-5915.patch | 217 +++++
.../libarchive/libarchive/CVE-2025-5916.patch | 116 +++
.../libarchive/libarchive/CVE-2025-5917.patch | 54 ++
.../libarchive/libarchive_3.6.2.bb | 3 +
.../linux/linux-yocto-rt_5.15.bb | 6 +-
.../linux/linux-yocto-tiny_5.15.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_5.15.bb | 26 +-
.../curl/curl/CVE-2024-11053-0001.patch | 340 ++++++++
.../curl/curl/CVE-2024-11053-0002.patch | 746 ++++++++++++++++++
.../curl/curl/CVE-2025-0167.patch | 175 ++++
meta/recipes-support/curl/curl_7.82.0.bb | 3 +
.../libsoup/libsoup-2.4/CVE-2025-4945.patch | 117 +++
.../libsoup/libsoup-2.4/CVE-2025-4969.patch | 54 +-
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
.../libsoup/libsoup/CVE-2025-4945.patch | 118 +++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
20 files changed, 2093 insertions(+), 61 deletions(-)
create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-5915.patch
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-5916.patch
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-5917.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-11053-0001.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-11053-0002.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2025-0167.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4945.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4945.patch
--
2.43.0
^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2025-07-09 15:19 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-21 2:09 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 01/11] ghostscript: Backport fix for CVE-2023-46751 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 02/11] curl: Fix CVE-2023-46218 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 03/11] qemu: Fix CVE-2023-5088 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 04/11] ffmpeg: fix for CVE-2022-3964 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 05/11] ffmpeg: fix for CVE-2022-3965 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 06/11] go: Fix CVE-2023-39326 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 07/11] openssh: backport Debian patch for CVE-2023-48795 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 08/11] perl: update 5.34.1 -> 5.34.3 Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 09/11] externalsrc: Ensure SRCREV is processed before accessing SRC_URI Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 10/11] python3-ptest: skip test_storlines Steve Sakoman
2023-12-21 2:09 ` [OE-core][kirkstone 11/11] testimage: Exclude wtmp from target-dumper commands Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-07-09 15:19 [OE-core][kirkstone 00/11] Patch review Steve Sakoman
2025-01-15 14:37 Steve Sakoman
2024-08-13 12:16 Steve Sakoman
2024-03-04 15:23 Steve Sakoman
2023-06-11 16:02 Steve Sakoman
2023-01-12 2:33 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox