diff options
author | Armin Kuster <akuster808@gmail.com> | 2015-04-08 08:08:36 -0700 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-04-17 22:39:30 +0100 |
commit | e8a260c9b8c3f63253da18a44a41146069fd05bd (patch) | |
tree | 07cf0f6325108ee17c7a0d0708e90b735e0cf697 | |
parent | 8e7d7e5c3a6f29cfbb281defab007bb8197cd75c (diff) | |
download | poky-e8a260c9b8c3f63253da18a44a41146069fd05bd.tar.gz |
util-linux: fix CVE-2014-9114
Backport a patch to fix CVE-2014-9114.
The patch has been integrated in util-linux-2.26.
[YOCTO #7180]
Hand applied do to version differencses.
(From OE-Core rev: de0c751f57de118bba808f85fa255bb2d99ed9cb)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-core/util-linux/util-linux/CVE-2014-9114.patch | 176 | ||||
-rw-r--r-- | meta/recipes-core/util-linux/util-linux_2.24.2.bb | 1 |
2 files changed, 177 insertions, 0 deletions
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2014-9114.patch b/meta/recipes-core/util-linux/util-linux/CVE-2014-9114.patch new file mode 100644 index 0000000000..46c5e8ecb7 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2014-9114.patch | |||
@@ -0,0 +1,176 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | This patch is for CVE-2014-9114. | ||
4 | This patch should be removed once util-linux is upgraded to 2.26. | ||
5 | |||
6 | Signed-off-by: Chen Qi <Qi.Chen@windriver.com> | ||
7 | |||
8 | From 89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc Mon Sep 17 00:00:00 2001 | ||
9 | From: Karel Zak <kzak@redhat.com> | ||
10 | Date: Thu, 27 Nov 2014 13:39:35 +0100 | ||
11 | Subject: [PATCH] libblkid: care about unsafe chars in cache | ||
12 | |||
13 | The high-level libblkid API uses /run/blkid/blkid.tab cache to | ||
14 | store probing results. The cache format is | ||
15 | |||
16 | <device NAME="value" ...>devname</device> | ||
17 | |||
18 | and unfortunately the cache code does not escape quotation marks: | ||
19 | |||
20 | # mkfs.ext4 -L 'AAA"BBB' | ||
21 | |||
22 | # cat /run/blkid/blkid.tab | ||
23 | ... | ||
24 | <device ... LABEL="AAA"BBB" ...>/dev/sdb1</device> | ||
25 | |||
26 | such string is later incorrectly parsed and blkid(8) returns | ||
27 | nonsenses. And for use-cases like | ||
28 | |||
29 | # eval $(blkid -o export /dev/sdb1) | ||
30 | |||
31 | it's also insecure. | ||
32 | |||
33 | Note that mount, udevd and blkid -p are based on low-level libblkid | ||
34 | API, it bypass the cache and directly read data from the devices. | ||
35 | |||
36 | The current udevd upstream does not depend on blkid(8) output at all, | ||
37 | it's directly linked with the library and all unsafe chars are encoded by | ||
38 | \x<hex> notation. | ||
39 | |||
40 | # mkfs.ext4 -L 'X"`/tmp/foo` "' /dev/sdb1 | ||
41 | # udevadm info --export-db | grep LABEL | ||
42 | ... | ||
43 | E: ID_FS_LABEL=X__/tmp/foo___ | ||
44 | E: ID_FS_LABEL_ENC=X\x22\x60\x2ftmp\x2ffoo\x60\x20\x22 | ||
45 | |||
46 | Signed-off-by: Karel Zak <kzak@redhat.com> | ||
47 | --- | ||
48 | libblkid/src/read.c | 21 ++++++++++++++++++--- | ||
49 | libblkid/src/save.c | 22 +++++++++++++++++++++- | ||
50 | misc-utils/blkid.8 | 5 ++++- | ||
51 | misc-utils/blkid.c | 4 ++-- | ||
52 | 4 files changed, 45 insertions(+), 7 deletions(-) | ||
53 | |||
54 | Index: util-linux-2.24.2/libblkid/src/save.c | ||
55 | =================================================================== | ||
56 | --- util-linux-2.24.2.orig/libblkid/src/save.c | ||
57 | +++ util-linux-2.24.2/libblkid/src/save.c | ||
58 | @@ -26,6 +26,21 @@ | ||
59 | |||
60 | #include "blkidP.h" | ||
61 | |||
62 | + | ||
63 | +static void save_quoted(const char *data, FILE *file) | ||
64 | +{ | ||
65 | + const char *p; | ||
66 | + | ||
67 | + fputc('"', file); | ||
68 | + for (p = data; p && *p; p++) { | ||
69 | + if ((unsigned char) *p == 0x22 || /* " */ | ||
70 | + (unsigned char) *p == 0x5c) /* \ */ | ||
71 | + fputc('\\', file); | ||
72 | + | ||
73 | + fputc(*p, file); | ||
74 | + } | ||
75 | + fputc('"', file); | ||
76 | +} | ||
77 | static int save_dev(blkid_dev dev, FILE *file) | ||
78 | { | ||
79 | struct list_head *p; | ||
80 | @@ -43,9 +58,14 @@ static int save_dev(blkid_dev dev, FILE | ||
81 | |||
82 | if (dev->bid_pri) | ||
83 | fprintf(file, " PRI=\"%d\"", dev->bid_pri); | ||
84 | + | ||
85 | list_for_each(p, &dev->bid_tags) { | ||
86 | blkid_tag tag = list_entry(p, struct blkid_struct_tag, bit_tags); | ||
87 | - fprintf(file, " %s=\"%s\"", tag->bit_name,tag->bit_val); | ||
88 | + | ||
89 | + fputc(' ', file); /* space between tags */ | ||
90 | + fputs(tag->bit_name, file); /* tag NAME */ | ||
91 | + fputc('=', file); /* separator between NAME and VALUE */ | ||
92 | + save_quoted(tag->bit_val, file); /* tag "VALUE" */ | ||
93 | } | ||
94 | fprintf(file, ">%s</device>\n", dev->bid_name); | ||
95 | |||
96 | Index: util-linux-2.24.2/misc-utils/blkid.8 | ||
97 | =================================================================== | ||
98 | --- util-linux-2.24.2.orig/misc-utils/blkid.8 | ||
99 | +++ util-linux-2.24.2/misc-utils/blkid.8 | ||
100 | @@ -193,7 +193,10 @@ partitions. This output format is \fBDE | ||
101 | .TP | ||
102 | .B export | ||
103 | print key=value pairs for easy import into the environment; this output format | ||
104 | -is automatically enabled when I/O Limits (\fB-i\fR option) are requested | ||
105 | +is automatically enabled when I/O Limits (\fB-i\fR option) are requested. | ||
106 | + | ||
107 | +The non-printing characters are encoded by ^ and M- notation and all | ||
108 | +potentially unsafe characters are escaped. | ||
109 | .RE | ||
110 | .TP | ||
111 | .BI \-O " offset" | ||
112 | Index: util-linux-2.24.2/misc-utils/blkid.c | ||
113 | =================================================================== | ||
114 | --- util-linux-2.24.2.orig/misc-utils/blkid.c | ||
115 | +++ util-linux-2.24.2/misc-utils/blkid.c | ||
116 | @@ -306,7 +306,7 @@ static void print_value(int output, int | ||
117 | printf("DEVNAME=%s\n", devname); | ||
118 | fputs(name, stdout); | ||
119 | fputs("=", stdout); | ||
120 | - safe_print(value, valsz, NULL); | ||
121 | + safe_print(value, valsz, " \\\"'$`<>"); | ||
122 | fputs("\n", stdout); | ||
123 | |||
124 | } else { | ||
125 | @@ -314,7 +314,7 @@ static void print_value(int output, int | ||
126 | printf("%s: ", devname); | ||
127 | fputs(name, stdout); | ||
128 | fputs("=\"", stdout); | ||
129 | - safe_print(value, valsz, "\""); | ||
130 | + safe_print(value, valsz, "\"\\"); | ||
131 | fputs("\" ", stdout); | ||
132 | } | ||
133 | } | ||
134 | Index: util-linux-2.24.2/libblkid/src/read.c | ||
135 | =================================================================== | ||
136 | --- util-linux-2.24.2.orig/libblkid/src/read.c | ||
137 | +++ util-linux-2.24.2/libblkid/src/read.c | ||
138 | @@ -252,8 +252,23 @@ static int parse_token(char **name, char | ||
139 | *value = skip_over_blank(*value + 1); | ||
140 | |||
141 | if (**value == '"') { | ||
142 | - end = strchr(*value + 1, '"'); | ||
143 | - if (!end) { | ||
144 | + char *p = end = *value + 1; | ||
145 | + | ||
146 | + /* convert 'foo\"bar' to 'foo"bar' */ | ||
147 | + while (*p) { | ||
148 | + if (*p == '\\') { | ||
149 | + p++; | ||
150 | + *end = *p; | ||
151 | + } else { | ||
152 | + *end = *p; | ||
153 | + if (*p == '"') | ||
154 | + break; | ||
155 | + } | ||
156 | + p++; | ||
157 | + end = ++p; | ||
158 | + } | ||
159 | + | ||
160 | + if (*end != '"') { | ||
161 | DBG(READ, blkid_debug("unbalanced quotes at: %s", *value)); | ||
162 | *cp = *value; | ||
163 | return -BLKID_ERR_CACHE; | ||
164 | @@ -261,11 +276,11 @@ static int parse_token(char **name, char | ||
165 | (*value)++; | ||
166 | *end = '\0'; | ||
167 | end++; | ||
168 | + end = ++p; | ||
169 | } else { | ||
170 | end = skip_over_word(*value); | ||
171 | if (*end) { | ||
172 | *end = '\0'; | ||
173 | - end++; | ||
174 | } | ||
175 | } | ||
176 | *cp = end; | ||
diff --git a/meta/recipes-core/util-linux/util-linux_2.24.2.bb b/meta/recipes-core/util-linux/util-linux_2.24.2.bb index ed753e48b3..bc92afd209 100644 --- a/meta/recipes-core/util-linux/util-linux_2.24.2.bb +++ b/meta/recipes-core/util-linux/util-linux_2.24.2.bb | |||
@@ -16,6 +16,7 @@ SRC_URI += "file://util-linux-ng-replace-siginterrupt.patch \ | |||
16 | file://fix-configure.patch \ | 16 | file://fix-configure.patch \ |
17 | file://fix-parallel-build.patch \ | 17 | file://fix-parallel-build.patch \ |
18 | file://util-linux-ensure-the-existence-of-directory-for-PAT.patch \ | 18 | file://util-linux-ensure-the-existence-of-directory-for-PAT.patch \ |
19 | file://CVE-2014-9114.patch \ | ||
19 | ${OLDHOST} \ | 20 | ${OLDHOST} \ |
20 | " | 21 | " |
21 | 22 | ||