Fixing vulnerabilities in glibc #yocto

Fixing vulnerabilities in glibc #yocto

[milunj]

[-- Attachment #1: Type: text/plain, Size: 1165 bytes --]

My greeting to all
I am new on yocto project and yocto build environment is also new to me ...
My working task is removing  vulnerabilities from libc library...
The processor is based on arm5 while newer yoctos 2.7.x and 3.x. do not provide environment support for arm5 based processors.

The glibc vulnerabilities are fixed in the latest glibc 2.30 released. ( https://sourceware.org/ml/libc-alpha/2019-08/msg00029.html ) package while yocto 2.6.x  includes 2.28 package.
Also some of glibc vulnerabilities are patched in 2.6.4 (\oecore-thud-20.0.4.tar\oecore-thud-20.0.4\meta\recipes-core\glibc\glibc):

CVE-2016-10739
CVE-2018-19591
CVE-2019-6488
CVE-2019-7309
CVE-2019-9169
while there are some others those have not been patched:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3590
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-7254
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20796
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9192

Does anyone know whether new vulnerability patches will be applied for yocto 2.6.5 and  when will be released yocto 2.6.5 ?
Thank you in advance
Milun

[-- Attachment #2: Type: text/html, Size: 2607 bytes --]

Re: [yocto] Fixing vulnerabilities in glibc #yocto

[Randy MacLeod]

[-- Attachment #1: Type: text/plain, Size: 3123 bytes --]

On 12/9/19 8:48 AM, milunj via Lists.Yoctoproject.Org wrote:
> My greeting to all
> I am new on yocto project and yocto build environment is also new to 
> me ...
> My working task is removing  vulnerabilities from libc library...
> The processor is based on arm5 while newer yoctos 2.7.x and 3.x. do 
> not provide environment support for arm5 based processors.
>
> The glibc vulnerabilities are fixed in the latest glibc 2.30 released. 
> <https://sourceware.org/ml/libc-alpha/2019-08/msg00029.html> package 
> while yocto 2.6.x  includes 2.28 package.
> Also some of glibc vulnerabilities are patched in 2.6.4 
> (\oecore-thud-20.0.4.tar\oecore-thud-20.0.4\meta\recipes-core\glibc\glibc):
>
> CVE-2016-10739
> CVE-2018-19591
> CVE-2019-6488
> CVE-2019-7309
> CVE-2019-9169
> while there are some others those have not been patched:
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3590
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-7254
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20796
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9192
>
> Does anyone know whether new vulnerability patches will be applied for 
> yocto 2.6.5 and  when will be released yocto 2.6.5 ?


Welcome Milun,

The 2.6.4 was released in early November 2019 and
I don't see any plans to ever release 2.6.5 but I've
CCed Armin to confirm if this is the official YP plan.

As for patches to the 'thud' branch after 2.6.4:
   ( see also: http://git.yoctoproject.org/cgit/cgit.cgi/poky/log/?h=thud )

$ cd ../poky.git; git checkout thud; git pull

$ git branch --contains yocto-2.6.4
* thud

$ git log --oneline yocto-2.6.4...
8cd3ee6e1a (HEAD -> thud, origin/thud) linux-yocto/4.14: meta-yocto-bsp 
update to 143
5bb142d7dd meta-yocto-bsp: Bump to the latest stable kernel for the BSPs
a8640d9a60 bitbake: fetch2: Ensure cached url data is matched to a datastore
3e42c33da5 documentation: Setup for 2.6.4 release
532f2df770 bitbake: bitbake-worker child process create group before 
registering SIGTERM handler

So it doesn't look like there are any CVE fixes there.

If you prefer not to do such work yourself, there are consultants and 
support organizations
that provide support for much longer than the ~1 year YP timeline. See 
the list of companies on:
https://www.yoctoproject.org/ecosystem/yocto-project-compatible-product-showcase/
The supported releases listed on page is out of date and I'll get it 
updated.

Good luck,

../Randy


> Thank you in advance
> Milun
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
>
> View/Reply Online (#47603): https://lists.yoctoproject.org/g/yocto/message/47603
> Mute This Topic: https://lists.yoctoproject.org/mt/67793912/3616765
> Mute #yocto: https://lists.yoctoproject.org/mk?hashtag=yocto&subid=6692177
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub  [randy.macleod@windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-


-- 
# Randy MacLeod
# Wind River Linux


[-- Attachment #2: Type: text/html, Size: 7650 bytes --]

Re: [yocto] Fixing vulnerabilities in glibc #yocto

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 1923 bytes --]

On Mon, 2019-12-09 at 05:48 -0800, milunj via Lists.Yoctoproject.Org
wrote:
> My greeting to all
> I am new on yocto project and yocto build environment is also new to
> me ...
> My working task is removing  vulnerabilities from libc library...
> The processor is based on arm5 while newer yoctos 2.7.x and 3.x. do
> not provide environment support for arm5 based processors.
> 
> The glibc vulnerabilities are fixed in the latest glibc 2.30
> released. package while yocto 2.6.x  includes 2.28 package.
> Also some of glibc vulnerabilities are patched in 2.6.4 (\oecore-
> thud-20.0.4.tar\oecore-thud-20.0.4\meta\recipes-core\glibc\glibc):
> 
> CVE-2016-10739
> CVE-2018-19591
> CVE-2019-6488
> CVE-2019-7309
> CVE-2019-9169
> while there are some others those have not been patched:
> 
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3590
> 
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-7254
> 
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20796
> 
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9192
> 
> Does anyone know whether new vulnerability patches will be applied
> for yocto 2.6.5 and  when will be released yocto 2.6.5 ?

it depends on contribution, if you can contribute the fixes thats best
for predictability, secondly, you can also open tickets in yocto bug
tracking system.
> Thank you in advance
> Milun
> 
>  
> 
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-Links: You receive all messages sent to this
> group.
> View/Reply Online (#47603): 
> https://lists.yoctoproject.org/g/yocto/message/47603
> Mute This Topic: https://lists.yoctoproject.org/mt/67793912/1997914
> Mute #yocto: 
> https://lists.yoctoproject.org/mk?hashtag=yocto&subid=6692173
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub  [raj.khem@
> gmail.com]-=-=-=-=-=-=-=-=-=-=-=-

[-- Attachment #2: Type: text/html, Size: 4675 bytes --]