* [OE-core][dunfell 0/3] Patch review
@ 2021-05-21 0:19 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2021-05-21 0:19 UTC (permalink / raw)
To: openembedded-core
Please review this final set of patches for the 3.1.8 release and have
comments back by end of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2172
The following changes since commit cc49591d84d241d90e3dccb3e174ddfd737de311:
meta/lib/oe/rootfs.py: Fix typo "Restoreing" -> "Restoring" (2021-05-14 07:16:38 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Richard Purdie (2):
Revert "cml1.bbclass: Return sorted list of cfg files"
sstate: Handle manifest 'corruption' issue
Stefan Ghinea (1):
boost: fix do_fetch failure
meta/classes/cml1.bbclass | 2 +-
meta/classes/sstate.bbclass | 16 +++++++++++++++-
meta/recipes-support/boost/boost-1.72.0.inc | 2 +-
3 files changed, 17 insertions(+), 3 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2021-07-20 21:57 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2021-07-20 21:57 UTC (permalink / raw)
To: openembedded-core
Please review this final set of patches for dunfell 3.1.10 release and have
comments back by end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2370
The following changes since commit 9b83aefa9c4a21d9dc1eea4a6b00af379466a288:
busybox: add tmpdir option into mktemp applet (2021-07-14 12:27:38 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (3):
linux-yocto/5.4: update to v5.4.131
linux-yocto/5.4: update to v5.4.132
kernel-devsrc: fix 32bit ARM devsrc builds
meta/recipes-kernel/linux/kernel-devsrc.bb | 2 +-
.../linux/linux-yocto-rt_5.4.bb | 6 ++---
.../linux/linux-yocto-tiny_5.4.bb | 8 +++----
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +++++++++----------
4 files changed, 19 insertions(+), 19 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2021-11-04 14:06 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2021-11-04 14:06 UTC (permalink / raw)
To: openembedded-core
Please review these patches for dunfell and have comments back by end of day
Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2876
The following changes since commit 6cd21ddc6f998eec4d9be05f080e32072fddd2bd:
tzdata: update 2021d -> 2021e (2021-11-03 11:17:55 +0000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Richard Purdie (2):
scripts/convert-srcuri: Backport SRC_URI conversion script from master
branch
meta/scripts: Manual git url branch additions
Steve Sakoman (1):
meta: Add explict branch to git SRC_URIs, handle github url changes
.../devtool/devtool-upgrade-test2_git.bb | 2 +-
.../devtool-upgrade-test2_git.bb.upgraded | 2 +-
meta/classes/devupstream.bbclass | 2 +-
.../distro/include/default-distrovars.inc | 2 +-
meta/lib/oeqa/selftest/cases/devtool.py | 4 +-
meta/lib/oeqa/selftest/cases/recipetool.py | 6 +-
meta/lib/oeqa/selftest/cases/sstatetests.py | 2 +-
meta/recipes-bsp/efibootmgr/efibootmgr_17.bb | 2 +-
meta/recipes-bsp/efivar/efivar_37.bb | 2 +-
meta/recipes-bsp/opensbi/opensbi_0.6.bb | 2 +-
meta/recipes-bsp/u-boot/libubootenv_0.3.1.bb | 2 +-
meta/recipes-bsp/u-boot/u-boot-common.inc | 2 +-
.../connman/connman-gnome_0.7.bb | 2 +-
.../libnss-mdns/libnss-mdns_0.14.1.bb | 2 +-
.../mobile-broadband-provider-info_git.bb | 2 +-
.../resolvconf/resolvconf_1.82.bb | 2 +-
meta/recipes-core/dbus-wait/dbus-wait_git.bb | 2 +-
meta/recipes-core/expat/expat_2.2.9.bb | 2 +-
meta/recipes-core/fts/fts_1.2.7.bb | 2 +-
.../glibc/cross-localedef-native_2.31.bb | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/ifupdown/ifupdown_0.8.35.bb | 2 +-
meta/recipes-core/libxcrypt/libxcrypt.inc | 2 +-
meta/recipes-core/musl/libucontext_git.bb | 2 +-
meta/recipes-core/musl/musl-obstack.bb | 2 +-
meta/recipes-core/musl/musl-utils.bb | 2 +-
meta/recipes-core/musl/musl_git.bb | 2 +-
meta/recipes-core/ncurses/ncurses.inc | 2 +-
meta/recipes-core/psplash/psplash_git.bb | 2 +-
meta/recipes-core/systemd/systemd.inc | 2 +-
.../update-rc.d/update-rc.d_0.8.bb | 2 +-
.../bootchart2/bootchart2_0.14.9.bb | 2 +-
.../btrfs-tools/btrfs-tools_5.4.1.bb | 2 +-
.../build-compare/build-compare_git.bb | 2 +-
.../createrepo-c/createrepo-c_0.15.7.bb | 2 +-
meta/recipes-devtools/distcc/distcc_3.3.3.bb | 2 +-
meta/recipes-devtools/dnf/dnf_4.2.2.bb | 2 +-
meta/recipes-devtools/e2fsprogs/e2fsprogs.inc | 2 +-
meta/recipes-devtools/file/file_5.38.bb | 2 +-
meta/recipes-devtools/glide/glide_0.13.3.bb | 2 +-
.../gnu-config/gnu-config_git.bb | 2 +-
meta/recipes-devtools/go/go-dep_0.5.4.bb | 2 +-
.../libcomps/libcomps_0.1.15.bb | 2 +-
meta/recipes-devtools/libdnf/libdnf_0.28.1.bb | 2 +-
.../librepo/librepo_1.11.2.bb | 2 +-
meta/recipes-devtools/llvm/llvm_git.bb | 2 +-
meta/recipes-devtools/mtd/mtd-utils_git.bb | 2 +-
meta/recipes-devtools/ninja/ninja_1.10.0.bb | 2 +-
.../patchelf/patchelf_0.10.bb | 2 +-
meta/recipes-devtools/rpm/rpm_4.14.2.1.bb | 2 +-
.../squashfs-tools/squashfs-tools_git.bb | 2 +-
.../systemd-bootchart_233.bb | 2 +-
.../tcf-agent/tcf-agent_git.bb | 2 +-
meta/recipes-devtools/unfs3/unfs3_git.bb | 2 +-
.../go-examples/go-helloworld_0.1.bb | 2 +-
.../iputils/iputils_s20190709.bb | 2 +-
.../recipes-extended/libaio/libaio_0.3.111.bb | 2 +-
meta/recipes-extended/libnsl/libnsl2_git.bb | 2 +-
.../recipes-extended/libnss-nis/libnss-nis.bb | 2 +-
.../libsolv/libsolv_0.7.10.bb | 2 +-
meta/recipes-extended/ltp/ltp_20200120.bb | 2 +-
meta/recipes-extended/procps/procps_3.3.16.bb | 2 +-
meta/recipes-extended/psmisc/psmisc_23.3.bb | 2 +-
.../rpcsvc-proto/rpcsvc-proto.bb | 2 +-
.../stress-ng/stress-ng_0.11.17.bb | 2 +-
meta/recipes-extended/sysklogd/sysklogd.inc | 2 +-
meta/recipes-extended/xinetd/xinetd_2.3.15.bb | 2 +-
.../libfakekey/libfakekey_git.bb | 2 +-
.../libmatchbox/libmatchbox_1.12.bb | 2 +-
.../libva/libva-utils_2.6.0.bb | 2 +-
.../matchbox-wm/matchbox-wm_1.2.2.bb | 2 +-
meta/recipes-graphics/mx/mx-1.0_1.4.7.bb | 2 +-
meta/recipes-graphics/piglit/piglit_git.bb | 2 +-
.../virglrenderer/virglrenderer_0.8.2.bb | 2 +-
meta/recipes-graphics/vulkan/assimp_5.0.1.bb | 2 +-
.../vulkan/vulkan-demos_git.bb | 6 +-
.../vulkan/vulkan-headers_1.1.126.0.bb | 2 +-
.../vulkan/vulkan-loader_1.1.126.0.bb | 2 +-
.../vulkan/vulkan-tools_1.1.126.0.bb | 2 +-
.../xinput-calibrator_git.bb | 2 +-
.../xorg-driver/xf86-video-intel_git.bb | 2 +-
meta/recipes-kernel/blktrace/blktrace_git.bb | 2 +-
meta/recipes-kernel/cryptodev/cryptodev.inc | 2 +-
meta/recipes-kernel/dtc/dtc.inc | 2 +-
.../kern-tools/kern-tools-native_git.bb | 2 +-
meta/recipes-kernel/kmod/kmod.inc | 2 +-
meta/recipes-kernel/powertop/powertop_2.10.bb | 2 +-
.../systemtap/systemtap_git.inc | 2 +-
.../gstreamer/gst-examples_1.16.0.bb | 2 +-
meta/recipes-multimedia/x264/x264_git.bb | 2 +-
meta/recipes-sato/l3afpad/l3afpad_git.bb | 2 +-
.../matchbox-config-gtk_0.2.bb | 2 +-
.../matchbox-desktop/matchbox-desktop_2.2.bb | 2 +-
.../matchbox-panel-2/matchbox-panel-2_2.11.bb | 2 +-
.../matchbox-terminal_0.2.bb | 2 +-
.../matchbox-theme-sato_0.2.bb | 2 +-
meta/recipes-sato/puzzles/puzzles_git.bb | 2 +-
.../sato-screenshot/sato-screenshot_0.3.bb | 2 +-
.../settings-daemon/settings-daemon_0.0.2.bb | 2 +-
.../bmap-tools/bmap-tools_3.5.bb | 2 +-
.../ca-certificates_20211016.bb | 2 +-
.../dos2unix/dos2unix_7.4.1.bb | 2 +-
.../gnome-desktop-testing_2018.1.bb | 2 +-
.../libjitterentropy_2.2.0.bb | 2 +-
meta/recipes-support/lz4/lz4_1.9.2.bb | 2 +-
.../p11-kit/p11-kit_0.23.22.bb | 2 +-
.../ptest-runner/ptest-runner_2.4.0.bb | 2 +-
.../rng-tools/rng-tools_6.9.bb | 2 +-
.../shared-mime-info/shared-mime-info_git.bb | 2 +-
meta/recipes-support/vim/vim.inc | 2 +-
scripts/contrib/convert-srcuri.py | 77 +++++++++++++++++++
scripts/lib/recipetool/create.py | 3 +
112 files changed, 195 insertions(+), 115 deletions(-)
create mode 100755 scripts/contrib/convert-srcuri.py
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2022-03-08 14:13 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2022-03-08 14:13 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3335
The following changes since commit 51844f2d60d77fb8cb46ffe460402f76ae216ca5:
uninative: Upgrade to 3.5 (2022-03-03 07:43:07 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Jose Quaresma (1):
sstate: inside the threadedpool don't write to the shared localdata
Richard Purdie (1):
systemd: Ensure uid/gid ranges are set deterministically
Ross Burton (1):
asciidoc: update git repository
meta/classes/sstate.bbclass | 2 +-
meta/recipes-core/systemd/systemd_244.5.bb | 2 ++
meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb | 2 +-
3 files changed, 4 insertions(+), 2 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2022-03-10 14:04 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2022-03-10 14:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3344
The following changes since commit 604146a242c3d5f5a9872bb756910f4bd1b58406:
sstate: inside the threadedpool don't write to the shared localdata (2022-03-07 07:05:33 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (1):
perf-tests: add bash into RDEPENDS (v5.12-rc5+)
Richard Purdie (1):
vim: Update to 8.2.4524 for further CVE fixes
sana kazi (1):
tiff: Add backports for two CVEs from upstream
meta/recipes-kernel/perf/perf.bb | 2 +-
...99c99f987dc32ae110370cfdd7df7975586b.patch | 28 +++++++++++++++++
...0712f4c3a5b449f70c57988260a667ddbdef.patch | 30 +++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 2 ++
meta/recipes-support/vim/vim.inc | 4 +--
5 files changed, 63 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/561599c99f987dc32ae110370cfdd7df7975586b.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2022-07-13 19:46 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2022-07-13 19:46 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3905
except for a known autobuilder intermittent issue on oe-selftest-centos:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14201
which passed on subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/79/builds/3820
The following changes since commit af25fff399fa623b4fd6efbca21e01ea6b4d1fd7:
qemu: add PACKAGECONFIG for capstone (2022-07-12 04:08:20 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Joshua Watt (1):
classes/cve-check: Move get_patches_cves to library
Ross Burton (1):
vim: upgrade to 9.0.0021
Steve Sakoman (1):
openssl: security upgrade 1.1.1p to 1.1.1q
meta/classes/cve-check.bbclass | 62 +-------------
meta/lib/oe/cve_check.py | 82 +++++++++++++++++++
.../{openssl_1.1.1p.bb => openssl_1.1.1q.bb} | 2 +-
meta/recipes-support/vim/vim.inc | 4 +-
4 files changed, 87 insertions(+), 63 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1p.bb => openssl_1.1.1q.bb} (98%)
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2022-09-29 2:05 Steve Sakoman
0 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2022-09-29 2:05 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4278
The following changes since commit 6227efbf03d2e7ca773ab29177705203f2550722:
linux-firmware: package new Qualcomm firmware (2022-09-26 12:29:44 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Hitendra Prajapati (1):
bluez: CVE-2022-39176 BlueZ allows physically proximate attackers
Martin Jansa (1):
create-pull-request: don't switch the git remote protocol to git://
Richard Purdie (1):
vim: Upgrade 9.0.0541 -> 9.0.0598
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
.../bluez5/bluez5/CVE-2022-39176.patch | 126 ++++++++++++++++++
meta/recipes-support/vim/vim.inc | 4 +-
scripts/create-pull-request | 2 +-
4 files changed, 130 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2022-39176.patch
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 0/3] Patch review
@ 2024-01-03 3:13 Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 1/3] go: Fix CVE-2023-39326 Steve Sakoman
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: Steve Sakoman @ 2024-01-03 3:13 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Thursday, January 4.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6406
The following changes since commit 94e9019d2f170a26206c2774381a1d183313ecaa:
testimage: drop target_dumper and host_dumper (2023-12-26 04:18:08 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Shubham Kulkarni (1):
tzdata: Upgrade to 2023d
Vijay Anusuri (2):
go: Fix CVE-2023-39326
qemu: Fix CVE-2023-5088
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2023-39326.patch | 181 ++++++++++++++++++
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-5088.patch | 114 +++++++++++
meta/recipes-extended/timezone/timezone.inc | 6 +-
5 files changed, 300 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-39326.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][dunfell 1/3] go: Fix CVE-2023-39326
2024-01-03 3:13 [OE-core][dunfell 0/3] Patch review Steve Sakoman
@ 2024-01-03 3:13 ` Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 2/3] qemu: Fix CVE-2023-5088 Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 3/3] tzdata: Upgrade to 2023d Steve Sakoman
2 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2024-01-03 3:13 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
A malicious HTTP sender can use chunk extensions to cause a receiver
reading from a request or response body to read many more bytes from
the network than are in the body. A malicious HTTP client can further
exploit this to cause a server to automatically read a large amount
of data (up to about 1GiB) when a handler fails to read the entire
body of a request. Chunk extensions are a little-used HTTP feature
which permit including additional metadata in a request or response
body sent using the chunked encoding. The net/http chunked encoding
reader discards this metadata. A sender can exploit this by inserting
a large metadata segment with each byte transferred. The chunk reader
now produces an error if the ratio of real body to encoded bytes grows
too small.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-39326
https://security-tracker.debian.org/tracker/CVE-2023-39326
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2023-39326.patch | 181 ++++++++++++++++++
2 files changed, 182 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-39326.patch
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc
index 091b778de8..b827a3606d 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -82,6 +82,7 @@ SRC_URI += "\
file://CVE-2023-24536_3.patch \
file://CVE-2023-39318.patch \
file://CVE-2023-39319.patch \
+ file://CVE-2023-39326.patch \
"
SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-39326.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-39326.patch
new file mode 100644
index 0000000000..998af361e8
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-39326.patch
@@ -0,0 +1,181 @@
+From 6446af942e2e2b161c4ec1b60d9703a2b55dc4dd Mon Sep 17 00:00:00 2001
+From: Damien Neil <dneil@google.com>
+Date: Tue, 7 Nov 2023 10:47:56 -0800
+Subject: [PATCH] [release-branch.go1.20] net/http: limit chunked data overhead
+
+The chunked transfer encoding adds some overhead to
+the content transferred. When writing one byte per
+chunk, for example, there are five bytes of overhead
+per byte of data transferred: "1\r\nX\r\n" to send "X".
+
+Chunks may include "chunk extensions",
+which we skip over and do not use.
+For example: "1;chunk extension here\r\nX\r\n".
+
+A malicious sender can use chunk extensions to add
+about 4k of overhead per byte of data.
+(The maximum chunk header line size we will accept.)
+
+Track the amount of overhead read in chunked data,
+and produce an error if it seems excessive.
+
+Updates #64433
+Fixes #64434
+Fixes CVE-2023-39326
+
+Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135
+Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+(cherry picked from commit 3473ae72ee66c60744665a24b2fde143e8964d4f)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2095407
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/547355
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/6446af942e2e2b161c4ec1b60d9703a2b55dc4dd]
+CVE: CVE-2023-39326
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/net/http/internal/chunked.go | 36 +++++++++++++---
+ src/net/http/internal/chunked_test.go | 59 +++++++++++++++++++++++++++
+ 2 files changed, 89 insertions(+), 6 deletions(-)
+
+diff --git a/src/net/http/internal/chunked.go b/src/net/http/internal/chunked.go
+index f06e572..ddbaacb 100644
+--- a/src/net/http/internal/chunked.go
++++ b/src/net/http/internal/chunked.go
+@@ -39,7 +39,8 @@ type chunkedReader struct {
+ n uint64 // unread bytes in chunk
+ err error
+ buf [2]byte
+- checkEnd bool // whether need to check for \r\n chunk footer
++ checkEnd bool // whether need to check for \r\n chunk footer
++ excess int64 // "excessive" chunk overhead, for malicious sender detection
+ }
+
+ func (cr *chunkedReader) beginChunk() {
+@@ -49,10 +50,38 @@ func (cr *chunkedReader) beginChunk() {
+ if cr.err != nil {
+ return
+ }
++ cr.excess += int64(len(line)) + 2 // header, plus \r\n after the chunk data
++ line = trimTrailingWhitespace(line)
++ line, cr.err = removeChunkExtension(line)
++ if cr.err != nil {
++ return
++ }
+ cr.n, cr.err = parseHexUint(line)
+ if cr.err != nil {
+ return
+ }
++ // A sender who sends one byte per chunk will send 5 bytes of overhead
++ // for every byte of data. ("1\r\nX\r\n" to send "X".)
++ // We want to allow this, since streaming a byte at a time can be legitimate.
++ //
++ // A sender can use chunk extensions to add arbitrary amounts of additional
++ // data per byte read. ("1;very long extension\r\nX\r\n" to send "X".)
++ // We don't want to disallow extensions (although we discard them),
++ // but we also don't want to allow a sender to reduce the signal/noise ratio
++ // arbitrarily.
++ //
++ // We track the amount of excess overhead read,
++ // and produce an error if it grows too large.
++ //
++ // Currently, we say that we're willing to accept 16 bytes of overhead per chunk,
++ // plus twice the amount of real data in the chunk.
++ cr.excess -= 16 + (2 * int64(cr.n))
++ if cr.excess < 0 {
++ cr.excess = 0
++ }
++ if cr.excess > 16*1024 {
++ cr.err = errors.New("chunked encoding contains too much non-data")
++ }
+ if cr.n == 0 {
+ cr.err = io.EOF
+ }
+@@ -133,11 +162,6 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) {
+ if len(p) >= maxLineLength {
+ return nil, ErrLineTooLong
+ }
+- p = trimTrailingWhitespace(p)
+- p, err = removeChunkExtension(p)
+- if err != nil {
+- return nil, err
+- }
+ return p, nil
+ }
+
+diff --git a/src/net/http/internal/chunked_test.go b/src/net/http/internal/chunked_test.go
+index d067165..b20747d 100644
+--- a/src/net/http/internal/chunked_test.go
++++ b/src/net/http/internal/chunked_test.go
+@@ -212,3 +212,62 @@ func TestChunkReadPartial(t *testing.T) {
+ }
+
+ }
++
++func TestChunkReaderTooMuchOverhead(t *testing.T) {
++ // If the sender is sending 100x as many chunk header bytes as chunk data,
++ // we should reject the stream at some point.
++ chunk := []byte("1;")
++ for i := 0; i < 100; i++ {
++ chunk = append(chunk, 'a') // chunk extension
++ }
++ chunk = append(chunk, "\r\nX\r\n"...)
++ const bodylen = 1 << 20
++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) {
++ if i < bodylen {
++ return chunk, nil
++ }
++ return []byte("0\r\n"), nil
++ }})
++ _, err := io.ReadAll(r)
++ if err == nil {
++ t.Fatalf("successfully read body with excessive overhead; want error")
++ }
++}
++
++func TestChunkReaderByteAtATime(t *testing.T) {
++ // Sending one byte per chunk should not trip the excess-overhead detection.
++ const bodylen = 1 << 20
++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) {
++ if i < bodylen {
++ return []byte("1\r\nX\r\n"), nil
++ }
++ return []byte("0\r\n"), nil
++ }})
++ got, err := io.ReadAll(r)
++ if err != nil {
++ t.Errorf("unexpected error: %v", err)
++ }
++ if len(got) != bodylen {
++ t.Errorf("read %v bytes, want %v", len(got), bodylen)
++ }
++}
++
++type funcReader struct {
++ f func(iteration int) ([]byte, error)
++ i int
++ b []byte
++ err error
++}
++
++func (r *funcReader) Read(p []byte) (n int, err error) {
++ if len(r.b) == 0 && r.err == nil {
++ r.b, r.err = r.f(r.i)
++ r.i++
++ }
++ n = copy(p, r.b)
++ r.b = r.b[n:]
++ if len(r.b) > 0 {
++ return n, nil
++ }
++ return n, r.err
++}
+--
+2.25.1
+
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [OE-core][dunfell 2/3] qemu: Fix CVE-2023-5088
2024-01-03 3:13 [OE-core][dunfell 0/3] Patch review Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 1/3] go: Fix CVE-2023-39326 Steve Sakoman
@ 2024-01-03 3:13 ` Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 3/3] tzdata: Upgrade to 2023d Steve Sakoman
2 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2024-01-03 3:13 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
A bug in QEMU could cause a guest I/O operation otherwise
addressed to an arbitrary disk offset to be targeted to
offset 0 instead (potentially overwriting the VM's boot code).
This change is to fix CVE-2023-5088.
Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-5088.patch | 114 ++++++++++++++++++
2 files changed, 115 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 9dd90e8789..4f856c749e 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -141,6 +141,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2023-3354.patch \
file://CVE-2023-3180.patch \
file://CVE-2020-24165.patch \
+ file://CVE-2023-5088.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
new file mode 100644
index 0000000000..db02210fa4
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch
@@ -0,0 +1,114 @@
+From 7d7512019fc40c577e2bdd61f114f31a9eb84a8e Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Wed, 6 Sep 2023 15:09:21 +0200
+Subject: [PATCH] hw/ide: reset: cancel async DMA operation before resetting
+ state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If there is a pending DMA operation during ide_bus_reset(), the fact
+that the IDEState is already reset before the operation is canceled
+can be problematic. In particular, ide_dma_cb() might be called and
+then use the reset IDEState which contains the signature after the
+reset. When used to construct the IO operation this leads to
+ide_get_sector() returning 0 and nsector being 1. This is particularly
+bad, because a write command will thus destroy the first sector which
+often contains a partition table or similar.
+
+Traces showing the unsolicited write happening with IDEState
+0x5595af6949d0 being used after reset:
+
+> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
+> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
+> ide_reset IDEstate 0x5595af6949d0
+> ide_reset IDEstate 0x5595af694da8
+> ide_bus_reset_aio aio_cancel
+> dma_aio_cancel dbs=0x7f64600089a0
+> dma_blk_cb dbs=0x7f64600089a0 ret=0
+> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
+> ahci_populate_sglist ahci(0x5595af6923f0)[0]
+> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
+> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
+> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
+> dma_blk_cb dbs=0x7f6420802010 ret=0
+
+> (gdb) p *qiov
+> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
+> iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
+> size = 512}}}
+> (gdb) bt
+> #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
+> cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
+> at ../block/block-backend.c:1682
+> #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
+> at ../softmmu/dma-helpers.c:179
+> #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
+> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
+> io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
+> io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
+> cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
+> dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
+> #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
+> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
+> cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
+> at ../softmmu/dma-helpers.c:280
+> #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
+> at ../hw/ide/core.c:953
+> #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
+> at ../softmmu/dma-helpers.c:107
+> #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
+> #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
+> at ../block/block-backend.c:1527
+> #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
+> #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
+> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
+> i1=<optimized out>) at ../util/coroutine-ucontext.c:177
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Tested-by: simon.rowe@nutanix.com
+Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e]
+CVE: CVE-2023-5088
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ hw/ide/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index b5e0dcd29b2..63ba665f3d2 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -2515,19 +2515,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
+
+ void ide_bus_reset(IDEBus *bus)
+ {
+- bus->unit = 0;
+- bus->cmd = 0;
+- ide_reset(&bus->ifs[0]);
+- ide_reset(&bus->ifs[1]);
+- ide_clear_hob(bus);
+-
+- /* pending async DMA */
++ /* pending async DMA - needs the IDEState before it is reset */
+ if (bus->dma->aiocb) {
+ trace_ide_bus_reset_aio();
+ blk_aio_cancel(bus->dma->aiocb);
+ bus->dma->aiocb = NULL;
+ }
+
++ bus->unit = 0;
++ bus->cmd = 0;
++ ide_reset(&bus->ifs[0]);
++ ide_reset(&bus->ifs[1]);
++ ide_clear_hob(bus);
++
+ /* reset dma provider too */
+ if (bus->dma->ops->reset) {
+ bus->dma->ops->reset(bus->dma);
+--
+GitLab
+
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [OE-core][dunfell 3/3] tzdata: Upgrade to 2023d
2024-01-03 3:13 [OE-core][dunfell 0/3] Patch review Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 1/3] go: Fix CVE-2023-39326 Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 2/3] qemu: Fix CVE-2023-5088 Steve Sakoman
@ 2024-01-03 3:13 ` Steve Sakoman
2 siblings, 0 replies; 11+ messages in thread
From: Steve Sakoman @ 2024-01-03 3:13 UTC (permalink / raw)
To: openembedded-core
From: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2956b1aa22129951b8c08ac06ff1ffd66811a26c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/timezone/timezone.inc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index 2960bfefe3..75f13cfc94 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -6,7 +6,7 @@ SECTION = "base"
LICENSE = "PD & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
-PV = "2023c"
+PV = "2023d"
SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \
http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \
@@ -14,5 +14,5 @@ SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
-SRC_URI[tzcode.sha256sum] = "46d17f2bb19ad73290f03a203006152e0fa0d7b11e5b71467c4a823811b214e7"
-SRC_URI[tzdata.sha256sum] = "3f510b5d1b4ae9bb38e485aa302a776b317fb3637bdb6404c4adf7b6cadd965c"
+SRC_URI[tzcode.sha256sum] = "e9a5f9e118886d2de92b62bb05510a28cc6c058d791c93bd6b84d3292c3c161e"
+SRC_URI[tzdata.sha256sum] = "dbca21970b0a8b8c0ceceec1d7b91fa903be0f6eca5ae732b5329672232a08f3"
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
end of thread, other threads:[~2024-01-03 3:14 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-03 3:13 [OE-core][dunfell 0/3] Patch review Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 1/3] go: Fix CVE-2023-39326 Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 2/3] qemu: Fix CVE-2023-5088 Steve Sakoman
2024-01-03 3:13 ` [OE-core][dunfell 3/3] tzdata: Upgrade to 2023d Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2022-09-29 2:05 [OE-core][dunfell 0/3] Patch review Steve Sakoman
2022-07-13 19:46 Steve Sakoman
2022-03-10 14:04 Steve Sakoman
2022-03-08 14:13 Steve Sakoman
2021-11-04 14:06 Steve Sakoman
2021-07-20 21:57 Steve Sakoman
2021-05-21 0:19 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox