diff options
author | Yogita Urade <yogita.urade@windriver.com> | 2024-04-16 10:39:05 +0000 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2024-04-21 06:33:34 -0700 |
commit | 70c869275acef71c69be8f88207741384c61fba0 (patch) | |
tree | a7d2a517c7cf4ed2847edac95de9165affa68b99 | |
parent | 888ea24812c21910e74c864313be56f02fad6c2e (diff) | |
download | poky-70c869275acef71c69be8f88207741384c61fba0.tar.gz |
ruby: fix CVE-2024-27281
ruby: RCE vulnerability with .rdoc_options in RDoc
References:
https://github.com/ruby/ruby/pull/10316
https://security-tracker.debian.org/tracker/CVE-2024-27281
(From OE-Core rev: d01b73c51ceead4911a9a9306dbe728f1db2e029)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch | 97 | ||||
-rw-r--r-- | meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 |
2 files changed, 98 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch new file mode 100644 index 0000000000..6f4b35a786 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch | |||
@@ -0,0 +1,97 @@ | |||
1 | From da7a0c7553ef7250ca665a3fecdc01dbaacbb43d Mon Sep 17 00:00:00 2001 | ||
2 | From: Nobuyoshi Nakada <nobu@ruby-lang.org> | ||
3 | Date: Mon, 15 Apr 2024 11:40:00 +0000 | ||
4 | Subject: [PATCH] Filter marshaled objets | ||
5 | |||
6 | CVE: CVE-2024-27281 | ||
7 | Upstream-Status: Backport [https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d] | ||
8 | |||
9 | Signed-off-by: Yogita Urade <yogita.urade@windriver.com> | ||
10 | --- | ||
11 | lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++------------------- | ||
12 | 1 file changed, 26 insertions(+), 19 deletions(-) | ||
13 | |||
14 | diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb | ||
15 | index 5ba671c..c793e49 100644 | ||
16 | --- a/lib/rdoc/store.rb | ||
17 | +++ b/lib/rdoc/store.rb | ||
18 | @@ -556,9 +556,7 @@ class RDoc::Store | ||
19 | def load_cache | ||
20 | #orig_enc = @encoding | ||
21 | |||
22 | - File.open cache_path, 'rb' do |io| | ||
23 | - @cache = Marshal.load io.read | ||
24 | - end | ||
25 | + @cache = marshal_load(cache_path) | ||
26 | |||
27 | load_enc = @cache[:encoding] | ||
28 | |||
29 | @@ -615,9 +613,7 @@ class RDoc::Store | ||
30 | def load_class_data klass_name | ||
31 | file = class_file klass_name | ||
32 | |||
33 | - File.open file, 'rb' do |io| | ||
34 | - Marshal.load io.read | ||
35 | - end | ||
36 | + marshal_load(file) | ||
37 | rescue Errno::ENOENT => e | ||
38 | error = MissingFileError.new(self, file, klass_name) | ||
39 | error.set_backtrace e.backtrace | ||
40 | @@ -630,14 +626,10 @@ class RDoc::Store | ||
41 | def load_method klass_name, method_name | ||
42 | file = method_file klass_name, method_name | ||
43 | |||
44 | - File.open file, 'rb' do |io| | ||
45 | - obj = Marshal.load io.read | ||
46 | - obj.store = self | ||
47 | - obj.parent = | ||
48 | - find_class_or_module(klass_name) || load_class(klass_name) unless | ||
49 | - obj.parent | ||
50 | - obj | ||
51 | - end | ||
52 | + obj = marshal_load(file) | ||
53 | + obj.store = self | ||
54 | + obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) | ||
55 | + obj | ||
56 | rescue Errno::ENOENT => e | ||
57 | error = MissingFileError.new(self, file, klass_name + method_name) | ||
58 | error.set_backtrace e.backtrace | ||
59 | @@ -650,11 +642,9 @@ class RDoc::Store | ||
60 | def load_page page_name | ||
61 | file = page_file page_name | ||
62 | |||
63 | - File.open file, 'rb' do |io| | ||
64 | - obj = Marshal.load io.read | ||
65 | - obj.store = self | ||
66 | - obj | ||
67 | - end | ||
68 | + obj = marshal_load(file) | ||
69 | + obj.store = self | ||
70 | + obj | ||
71 | rescue Errno::ENOENT => e | ||
72 | error = MissingFileError.new(self, file, page_name) | ||
73 | error.set_backtrace e.backtrace | ||
74 | @@ -976,4 +966,21 @@ class RDoc::Store | ||
75 | @unique_modules | ||
76 | end | ||
77 | |||
78 | + private | ||
79 | + def marshal_load(file) | ||
80 | + File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} | ||
81 | + end | ||
82 | + | ||
83 | + MarshalFilter = proc do |obj| | ||
84 | + case obj | ||
85 | + when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text | ||
86 | + else | ||
87 | + unless obj.class.name.start_with?("RDoc::") | ||
88 | + raise TypeError, "not permitted class: #{obj.class.name}" | ||
89 | + end | ||
90 | + end | ||
91 | + obj | ||
92 | + end | ||
93 | + private_constant :MarshalFilter | ||
94 | + | ||
95 | end | ||
96 | -- | ||
97 | 2.35.5 | ||
diff --git a/meta/recipes-devtools/ruby/ruby_3.1.3.bb b/meta/recipes-devtools/ruby/ruby_3.1.3.bb index 228a2204db..2ad3c9e207 100644 --- a/meta/recipes-devtools/ruby/ruby_3.1.3.bb +++ b/meta/recipes-devtools/ruby/ruby_3.1.3.bb | |||
@@ -33,6 +33,7 @@ SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \ | |||
33 | file://CVE-2023-28755.patch \ | 33 | file://CVE-2023-28755.patch \ |
34 | file://CVE-2023-36617_1.patch \ | 34 | file://CVE-2023-36617_1.patch \ |
35 | file://CVE-2023-36617_2.patch \ | 35 | file://CVE-2023-36617_2.patch \ |
36 | file://CVE-2024-27281.patch \ | ||
36 | " | 37 | " |
37 | UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/" | 38 | UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/" |
38 | 39 | ||