From 004d49958a83b2ab92301b67134d6910313d94d8 Mon Sep 17 00:00:00 2001 From: Brad Bishop Date: Tue, 2 Oct 2018 23:54:45 +0200 Subject: poky: sumo refresh 36d5cee56b..d240b885f2 Update poky to sumo HEAD. Changqing Li (1): libsndfile1: CVE-2018-13139 Chen Qi (2): runqemu: add SIGTERM handler to make sure things are cleaned up runqemu: fix handling of SIGTERM and the problem of line wrapping Hongxu Jia (1): nasm: fix CVE-2018-10016 Ioan-Adrian Ratiu (1): rootfs: always update the opkg index Jagadeesh Krishnanjanappa (1): runqemu: exit gracefully with an error message if qemu system is not evaluated Joe Slater (1): libtiff: fix CVE-2017-17095 Khem Raj (1): x264: Disable asm on musl/x86 Nicolas Dechesne (1): checklayer: avoid recursive loop in add_layer_dependencies Ola x Nilsson (1): externalsrc.bbclass: Set BB_DONT_CACHE for non-target recipes Richard Purdie (1): recipes: Update git.gnome.org addresses after upstream changes Sinan Kaya (3): libxml2: CVE-2018-14404 python3: CVE-2018-1061 git: CVE-2018-11233 Change-Id: Ic2daa2803af197180e605346f59bab03f8264e19 Signed-off-by: Brad Bishop --- .../git/files/CVE-2018-11233.patch | 44 ++++++ poky/meta/recipes-devtools/git/git.inc | 3 +- .../0001-eval-Eliminate-division-by-zero.patch | 40 +++++ poky/meta/recipes-devtools/nasm/nasm_2.13.03.bb | 1 + .../python/python3/CVE-2018-1061.patch | 165 +++++++++++++++++++++ poky/meta/recipes-devtools/python/python3_3.5.5.bb | 1 + 6 files changed, 253 insertions(+), 1 deletion(-) create mode 100644 poky/meta/recipes-devtools/git/files/CVE-2018-11233.patch create mode 100644 poky/meta/recipes-devtools/nasm/nasm/0001-eval-Eliminate-division-by-zero.patch create mode 100644 poky/meta/recipes-devtools/python/python3/CVE-2018-1061.patch (limited to 'poky/meta/recipes-devtools') diff --git a/poky/meta/recipes-devtools/git/files/CVE-2018-11233.patch b/poky/meta/recipes-devtools/git/files/CVE-2018-11233.patch new file mode 100644 index 000000000..f4468cf2f --- /dev/null +++ b/poky/meta/recipes-devtools/git/files/CVE-2018-11233.patch @@ -0,0 +1,44 @@ +From 014281e62b7920a6d710a85089e00ca012b0744c Mon Sep 17 00:00:00 2001 +From: Jeff King +Date: Sun, 13 May 2018 12:09:42 -0400 +Subject: [PATCH] is_ntfs_dotgit: use a size_t for traversing string + +We walk through the "name" string using an int, which can +wrap to a negative value and cause us to read random memory +before our array (e.g., by creating a tree with a name >2GB, +since "int" is still 32 bits even on most 64-bit platforms). +Worse, this is easy to trigger during the fsck_tree() check, +which is supposed to be protecting us from malicious +garbage. + +Note one bit of trickiness in the existing code: we +sometimes assign -1 to "len" at the end of the loop, and +then rely on the "len++" in the for-loop's increment to take +it back to 0. This is still legal with a size_t, since +assigning -1 will turn into SIZE_MAX, which then wraps +around to 0 on increment. + +Signed-off-by: Jeff King +CVE: CVE-2018-11233 +Upstream-Status: Backport[https://github.com/git/git/commit/11a9f4d807a0d71dc6eff51bb87baf4ca2cccf1d] +Signed-off-by: Sinan Kaya +--- + path.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/path.c b/path.c +index da8b65573..d31c795ff 100644 +--- a/path.c ++++ b/path.c +@@ -1305,7 +1305,7 @@ static int only_spaces_and_periods(const char *path, size_t len, size_t skip) + + int is_ntfs_dotgit(const char *name) + { +- int len; ++ size_t len; + + for (len = 0; ; len++) + if (!name[len] || name[len] == '\\' || is_dir_sep(name[len])) { +-- +2.19.0 + diff --git a/poky/meta/recipes-devtools/git/git.inc b/poky/meta/recipes-devtools/git/git.inc index bea23ec78..8603c045c 100644 --- a/poky/meta/recipes-devtools/git/git.inc +++ b/poky/meta/recipes-devtools/git/git.inc @@ -8,7 +8,8 @@ PROVIDES_append_class-native = " git-replacement-native" SRC_URI = "${KERNELORG_MIRROR}/software/scm/git/git-${PV}.tar.gz;name=tarball \ ${KERNELORG_MIRROR}/software/scm/git/git-manpages-${PV}.tar.gz;name=manpages \ - file://CVE-2018-11235.patch" + file://CVE-2018-11235.patch \ + file://CVE-2018-11233.patch" S = "${WORKDIR}/git-${PV}" diff --git a/poky/meta/recipes-devtools/nasm/nasm/0001-eval-Eliminate-division-by-zero.patch b/poky/meta/recipes-devtools/nasm/nasm/0001-eval-Eliminate-division-by-zero.patch new file mode 100644 index 000000000..6c332497c --- /dev/null +++ b/poky/meta/recipes-devtools/nasm/nasm/0001-eval-Eliminate-division-by-zero.patch @@ -0,0 +1,40 @@ +From ceec0d818798aeaa75ed4907e6135b0247ed46b2 Mon Sep 17 00:00:00 2001 +From: Cyrill Gorcunov +Date: Sun, 14 Oct 2018 01:26:19 +0300 +Subject: [PATCH] eval: Eliminate division by zero + +When doing division we should detect if the value we're +divided by is not zero. Instead of is_unknown() helper +we should use is_just_unknown(). + +https://bugzilla.nasm.us/show_bug.cgi?id=3392515 +https://bugzilla.nasm.us/show_bug.cgi?id=3392473 + +Reported-by: Jun +Reported-by: stuartly +Signed-off-by: Cyrill Gorcunov + +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/ceec0d818798aeaa75ed4907e6135b0247ed46b2.patch] +CVE: CVE-2018-10016 +Signed-off-by: Hongxu Jia + +--- + asm/eval.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/asm/eval.c b/asm/eval.c +index 1a6680f..7e727a4 100644 +--- a/asm/eval.c ++++ b/asm/eval.c +@@ -580,7 +580,7 @@ static expr *expr5(int critical) + " scalar values"); + return NULL; + } +- if (j != '*' && !is_unknown(f) && reloc_value(f) == 0) { ++ if (j != '*' && !is_just_unknown(f) && reloc_value(f) == 0) { + nasm_error(ERR_NONFATAL, "division by zero"); + return NULL; + } +-- +2.10.2 + diff --git a/poky/meta/recipes-devtools/nasm/nasm_2.13.03.bb b/poky/meta/recipes-devtools/nasm/nasm_2.13.03.bb index 6a02df485..730db1d8c 100644 --- a/poky/meta/recipes-devtools/nasm/nasm_2.13.03.bb +++ b/poky/meta/recipes-devtools/nasm/nasm_2.13.03.bb @@ -8,6 +8,7 @@ SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ file://0001-assemble-Check-global-line-limit.patch \ file://0001-fix-CVE-2018-8882.patch \ file://0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch \ + file://0001-eval-Eliminate-division-by-zero.patch \ " SRC_URI[md5sum] = "0c581d482f39d5111879ca9601938f74" diff --git a/poky/meta/recipes-devtools/python/python3/CVE-2018-1061.patch b/poky/meta/recipes-devtools/python/python3/CVE-2018-1061.patch new file mode 100644 index 000000000..6373be389 --- /dev/null +++ b/poky/meta/recipes-devtools/python/python3/CVE-2018-1061.patch @@ -0,0 +1,165 @@ +From 6d7ef39198856395edd62ef143bfcfaaf2ed6e25 Mon Sep 17 00:00:00 2001 +From: Ned Deily +Date: Sun, 11 Mar 2018 14:29:05 -0400 +Subject: [PATCH] [3.5] bpo-32981: Fix catastrophic backtracking vulns + (GH-5955) (#6034) + +* Prevent low-grade poplib REDOS (CVE-2018-1060) + +The regex to test a mail server's timestamp is susceptible to +catastrophic backtracking on long evil responses from the server. + +Happily, the maximum length of malicious inputs is 2K thanks +to a limit introduced in the fix for CVE-2013-1752. + +A 2KB evil response from the mail server would result in small slowdowns +(milliseconds vs. microseconds) accumulated over many apop calls. +This is a potential DOS vector via accumulated slowdowns. + +Replace it with a similar non-vulnerable regex. + +The new regex is RFC compliant. +The old regex was non-compliant in edge cases. + +* Prevent difflib REDOS (CVE-2018-1061) + +The default regex for IS_LINE_JUNK is susceptible to +catastrophic backtracking. +This is a potential DOS vector. + +Replace it with an equivalent non-vulnerable regex. + +Also introduce unit and REDOS tests for difflib. + +Co-authored-by: Tim Peters +Co-authored-by: Christian Heimes . +(cherry picked from commit 0e6c8ee2358a2e23117501826c008842acb835ac) +CVE: CVE-2018-1061 +CVE: CVE-2018-1060 +Upstream-Status: Backport [https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b] +Signed-off-by: Sinan Kaya +--- + Lib/difflib.py | 2 +- + Lib/poplib.py | 2 +- + Lib/test/test_difflib.py | 22 ++++++++++++++++++- + Lib/test/test_poplib.py | 12 +++++++++- + Misc/ACKS | 1 + + .../2018-03-02-10-24-52.bpo-32981.O_qDyj.rst | 4 ++++ + 6 files changed, 39 insertions(+), 4 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst + +diff --git a/Lib/difflib.py b/Lib/difflib.py +index 076bbac01d..b4ec335056 100644 +--- a/Lib/difflib.py ++++ b/Lib/difflib.py +@@ -1083,7 +1083,7 @@ class Differ: + + import re + +-def IS_LINE_JUNK(line, pat=re.compile(r"\s*#?\s*$").match): ++def IS_LINE_JUNK(line, pat=re.compile(r"\s*(?:#\s*)?$").match): + r""" + Return 1 for ignorable line: iff `line` is blank or contains a single '#'. + +diff --git a/Lib/poplib.py b/Lib/poplib.py +index 516b6f060d..2437ea0e27 100644 +--- a/Lib/poplib.py ++++ b/Lib/poplib.py +@@ -308,7 +308,7 @@ class POP3: + return self._shortcmd('RPOP %s' % user) + + +- timestamp = re.compile(br'\+OK.*(<[^>]+>)') ++ timestamp = re.compile(br'\+OK.[^<]*(<.*>)') + + def apop(self, user, password): + """Authorisation +diff --git a/Lib/test/test_difflib.py b/Lib/test/test_difflib.py +index ab9debf8e2..b6c8a7dd5b 100644 +--- a/Lib/test/test_difflib.py ++++ b/Lib/test/test_difflib.py +@@ -466,13 +466,33 @@ class TestBytes(unittest.TestCase): + list(generator(*args)) + self.assertEqual(msg, str(ctx.exception)) + ++class TestJunkAPIs(unittest.TestCase): ++ def test_is_line_junk_true(self): ++ for line in ['#', ' ', ' #', '# ', ' # ', '']: ++ self.assertTrue(difflib.IS_LINE_JUNK(line), repr(line)) ++ ++ def test_is_line_junk_false(self): ++ for line in ['##', ' ##', '## ', 'abc ', 'abc #', 'Mr. Moose is up!']: ++ self.assertFalse(difflib.IS_LINE_JUNK(line), repr(line)) ++ ++ def test_is_line_junk_REDOS(self): ++ evil_input = ('\t' * 1000000) + '##' ++ self.assertFalse(difflib.IS_LINE_JUNK(evil_input)) ++ ++ def test_is_character_junk_true(self): ++ for char in [' ', '\t']: ++ self.assertTrue(difflib.IS_CHARACTER_JUNK(char), repr(char)) ++ ++ def test_is_character_junk_false(self): ++ for char in ['a', '#', '\n', '\f', '\r', '\v']: ++ self.assertFalse(difflib.IS_CHARACTER_JUNK(char), repr(char)) + + def test_main(): + difflib.HtmlDiff._default_prefix = 0 + Doctests = doctest.DocTestSuite(difflib) + run_unittest( + TestWithAscii, TestAutojunk, TestSFpatches, TestSFbugs, +- TestOutputFormat, TestBytes, Doctests) ++ TestOutputFormat, TestBytes, TestJunkAPIs, Doctests) + + if __name__ == '__main__': + test_main() +diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py +index bceeb93ad1..799e403652 100644 +--- a/Lib/test/test_poplib.py ++++ b/Lib/test/test_poplib.py +@@ -300,9 +300,19 @@ class TestPOP3Class(TestCase): + def test_rpop(self): + self.assertOK(self.client.rpop('foo')) + +- def test_apop(self): ++ def test_apop_normal(self): + self.assertOK(self.client.apop('foo', 'dummypassword')) + ++ def test_apop_REDOS(self): ++ # Replace welcome with very long evil welcome. ++ # NB The upper bound on welcome length is currently 2048. ++ # At this length, evil input makes each apop call take ++ # on the order of milliseconds instead of microseconds. ++ evil_welcome = b'+OK' + (b'<' * 1000000) ++ with test_support.swap_attr(self.client, 'welcome', evil_welcome): ++ # The evil welcome is invalid, so apop should throw. ++ self.assertRaises(poplib.error_proto, self.client.apop, 'a', 'kb') ++ + def test_top(self): + expected = (b'+OK 116 bytes', + [b'From: postmaster@python.org', b'Content-Type: text/plain', +diff --git a/Misc/ACKS b/Misc/ACKS +index 1a35aad66c..72c5d740bd 100644 +--- a/Misc/ACKS ++++ b/Misc/ACKS +@@ -341,6 +341,7 @@ Kushal Das + Jonathan Dasteel + Pierre-Yves David + A. Jesse Jiryu Davis ++Jamie (James C.) Davis + Merlijn van Deen + John DeGood + Ned Deily +diff --git a/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst b/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst +new file mode 100644 +index 0000000000..9ebabb44f9 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst +@@ -0,0 +1,4 @@ ++Regexes in difflib and poplib were vulnerable to catastrophic backtracking. ++These regexes formed potential DOS vectors (REDOS). They have been ++refactored. This resolves CVE-2018-1060 and CVE-2018-1061. ++Patch by Jamie Davis. +-- +2.19.0 + diff --git a/poky/meta/recipes-devtools/python/python3_3.5.5.bb b/poky/meta/recipes-devtools/python/python3_3.5.5.bb index 4dae4fa4c..c28be3292 100644 --- a/poky/meta/recipes-devtools/python/python3_3.5.5.bb +++ b/poky/meta/recipes-devtools/python/python3_3.5.5.bb @@ -37,6 +37,7 @@ SRC_URI += "\ file://configure.ac-fix-LIBPL.patch \ file://0001-Issue-21272-Use-_sysconfigdata.py-to-initialize-dist.patch \ file://pass-missing-libraries-to-Extension-for-mul.patch \ + file://CVE-2018-1061.patch \ " SRC_URI[md5sum] = "f3763edf9824d5d3a15f5f646083b6e0" SRC_URI[sha256sum] = "063d2c3b0402d6191b90731e0f735c64830e7522348aeb7ed382a83165d45009" -- cgit v1.2.3