diff options
author | Peter Marko <peter.marko@siemens.com> | 2023-08-10 22:22:37 +0200 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-08-16 03:55:13 -1000 |
commit | 729e5e306f02535df51dc394cd45f7a7c4d16cf4 (patch) | |
tree | 924bb316b33fc97639e31982cd5cf6c6cd251bda | |
parent | 3e0bb5455bcef1081ed0b165bbddb3fd1f385858 (diff) | |
download | poky-729e5e306f02535df51dc394cd45f7a7c4d16cf4.tar.gz |
procps: patch CVE-2023-4016
Backport patch from upstream master.
There were three changes needed to apply the patch:
* move NEWS change to start of the file
* change file location from src/ps/ to ps/
* change xmalloc/xcmalloc to malloc/cmalloc
The x*malloc functions were introduced in commit in future version.
https://gitlab.com/procps-ng/procps/-/commit/584028dbe513127ef68c55aa631480454bcc26bf
They call the original function plus additionally throw error when out of memory.
https://gitlab.com/procps-ng/procps/-/blob/v4.0.3/local/xalloc.h?ref_type=tags
So this replacement is correct in context of our version.
(From OE-Core rev: 1632c7223b2f8cd595e1ba20bc006c68fc833295)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-extended/procps/procps/CVE-2023-4016.patch | 85 | ||||
-rw-r--r-- | meta/recipes-extended/procps/procps_3.3.16.bb | 1 |
2 files changed, 86 insertions, 0 deletions
diff --git a/meta/recipes-extended/procps/procps/CVE-2023-4016.patch b/meta/recipes-extended/procps/procps/CVE-2023-4016.patch new file mode 100644 index 0000000000..50582a8649 --- /dev/null +++ b/meta/recipes-extended/procps/procps/CVE-2023-4016.patch | |||
@@ -0,0 +1,85 @@ | |||
1 | From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 | ||
2 | From: Craig Small <csmall@dropbear.xyz> | ||
3 | Date: Thu, 10 Aug 2023 21:18:38 +1000 | ||
4 | Subject: [PATCH] ps: Fix possible buffer overflow in -C option | ||
5 | |||
6 | ps allocates memory using malloc(length of arg * len of struct). | ||
7 | In certain strange circumstances, the arg length could be very large | ||
8 | and the multiplecation will overflow, allocating a small amount of | ||
9 | memory. | ||
10 | |||
11 | Subsequent strncpy() will then write into unallocated memory. | ||
12 | The fix is to use calloc. It's slower but this is a one-time | ||
13 | allocation. Other malloc(x * y) calls have also been replaced | ||
14 | by calloc(x, y) | ||
15 | |||
16 | References: | ||
17 | https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 | ||
18 | https://nvd.nist.gov/vuln/detail/CVE-2023-4016 | ||
19 | https://gitlab.com/procps-ng/procps/-/issues/297 | ||
20 | https://bugs.debian.org/1042887 | ||
21 | |||
22 | Signed-off-by: Craig Small <csmall@dropbear.xyz> | ||
23 | |||
24 | CVE: CVE-2023-4016 | ||
25 | Upstream-Status: Backport [https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413] | ||
26 | |||
27 | Signed-off-by: Peter Marko <peter.marko@siemens.com> | ||
28 | |||
29 | --- | ||
30 | NEWS | 1 + | ||
31 | ps/parser.c | 8 ++++---- | ||
32 | 2 files changed, 5 insertions(+), 4 deletions(-) | ||
33 | |||
34 | diff --git a/NEWS b/NEWS | ||
35 | index b9509734..64fa3da8 100644 | ||
36 | --- a/NEWS | ||
37 | +++ b/NEWS | ||
38 | @@ -1,3 +1,5 @@ | ||
39 | + * ps: Fix buffer overflow in -C option CVE-2023-4016 Debian #1042887, issue #297 | ||
40 | + | ||
41 | procps-ng-3.3.16 | ||
42 | ---------------- | ||
43 | * library: Increment to 8:2:0 | ||
44 | diff --git a/ps/parser.c b/ps/parser.c | ||
45 | index 248aa741..15873dfa 100644 | ||
46 | --- a/ps/parser.c | ||
47 | +++ b/ps/parser.c | ||
48 | @@ -184,7 +184,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s | ||
49 | const char *err; /* error code that could or did happen */ | ||
50 | /*** prepare to operate ***/ | ||
51 | node = malloc(sizeof(selection_node)); | ||
52 | - node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ | ||
53 | node->n = 0; | ||
54 | buf = strdup(arg); | ||
55 | /*** sanity check and count items ***/ | ||
56 | @@ -205,6 +204,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s | ||
57 | } while (*++walk); | ||
58 | if(need_item) goto parse_error; | ||
59 | node->n = items; | ||
60 | + node->u = calloc(items, sizeof(sel_union)); | ||
61 | /*** actually parse the list ***/ | ||
62 | walk = buf; | ||
63 | while(items--){ | ||
64 | @@ -1031,15 +1031,15 @@ static const char *parse_trailing_pids(void){ | ||
65 | thisarg = ps_argc - 1; /* we must be at the end now */ | ||
66 | |||
67 | pidnode = malloc(sizeof(selection_node)); | ||
68 | - pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ | ||
69 | + pidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ | ||
70 | pidnode->n = 0; | ||
71 | |||
72 | grpnode = malloc(sizeof(selection_node)); | ||
73 | - grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ | ||
74 | + grpnode->u = calloc(i,sizeof(sel_union)); /* waste is insignificant */ | ||
75 | grpnode->n = 0; | ||
76 | |||
77 | sidnode = malloc(sizeof(selection_node)); | ||
78 | - sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ | ||
79 | + sidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ | ||
80 | sidnode->n = 0; | ||
81 | |||
82 | while(i--){ | ||
83 | -- | ||
84 | GitLab | ||
85 | |||
diff --git a/meta/recipes-extended/procps/procps_3.3.16.bb b/meta/recipes-extended/procps/procps_3.3.16.bb index 3a8289b359..ac27734a6f 100644 --- a/meta/recipes-extended/procps/procps_3.3.16.bb +++ b/meta/recipes-extended/procps/procps_3.3.16.bb | |||
@@ -14,6 +14,7 @@ inherit autotools gettext pkgconfig update-alternatives | |||
14 | 14 | ||
15 | SRC_URI = "git://gitlab.com/procps-ng/procps.git;protocol=https;branch=master \ | 15 | SRC_URI = "git://gitlab.com/procps-ng/procps.git;protocol=https;branch=master \ |
16 | file://sysctl.conf \ | 16 | file://sysctl.conf \ |
17 | file://CVE-2023-4016.patch \ | ||
17 | " | 18 | " |
18 | SRCREV = "59c88e18f29000ceaf7e5f98181b07be443cf12f" | 19 | SRCREV = "59c88e18f29000ceaf7e5f98181b07be443cf12f" |
19 | 20 | ||