diff options
author | Steve Sakoman <steve@sakoman.com> | 2022-06-13 06:11:15 -1000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-06-22 23:46:32 +0100 |
commit | 95cda9d09165412d1345a089a845d3adaf4ff851 (patch) | |
tree | 664f9bb9558d5837c956354cb84f440f93829513 | |
parent | 238fb89434211b400f0201a8f3383babc5f9fa35 (diff) | |
download | poky-95cda9d09165412d1345a089a845d3adaf4ff851.tar.gz |
cups: fix CVE-2022-26691
In scheduler/cert.c the previous algorithm didn't expect the strings can
have a different length, so one string can be a substring of the other
and such substring was reported as equal to the longer string.
Backport patch from upstream to fix:
https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444
CVE: CVE-2022-26691
(From OE-Core rev: cc657868d31cc8b4218a07aa10fa098c379e473c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-extended/cups/cups.inc | 3 | ||||
-rw-r--r-- | meta/recipes-extended/cups/cups/CVE-2022-26691.patch | 33 |
2 files changed, 35 insertions, 1 deletions
diff --git a/meta/recipes-extended/cups/cups.inc b/meta/recipes-extended/cups/cups.inc index 15f46937e1..21c56e1430 100644 --- a/meta/recipes-extended/cups/cups.inc +++ b/meta/recipes-extended/cups/cups.inc | |||
@@ -13,6 +13,7 @@ SRC_URI = "https://github.com/apple/cups/releases/download/v${PV}/${BP}-source.t | |||
13 | file://0002-don-t-try-to-run-generated-binaries.patch \ | 13 | file://0002-don-t-try-to-run-generated-binaries.patch \ |
14 | file://0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch \ | 14 | file://0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch \ |
15 | file://0004-cups-fix-multilib-install-file-conflicts.patch\ | 15 | file://0004-cups-fix-multilib-install-file-conflicts.patch\ |
16 | file://CVE-2022-26691.patch \ | ||
16 | " | 17 | " |
17 | 18 | ||
18 | UPSTREAM_CHECK_URI = "https://github.com/apple/cups/releases" | 19 | UPSTREAM_CHECK_URI = "https://github.com/apple/cups/releases" |
@@ -119,4 +120,4 @@ cups_sysroot_preprocess () { | |||
119 | 120 | ||
120 | # -25317 concerns /var/log/cups having lp ownership. Our /var/log/cups is | 121 | # -25317 concerns /var/log/cups having lp ownership. Our /var/log/cups is |
121 | # root:root, so this doesn't apply. | 122 | # root:root, so this doesn't apply. |
122 | CVE_CHECK_WHITELIST += "CVE-2021-25317" \ No newline at end of file | 123 | CVE_CHECK_WHITELIST += "CVE-2021-25317" |
diff --git a/meta/recipes-extended/cups/cups/CVE-2022-26691.patch b/meta/recipes-extended/cups/cups/CVE-2022-26691.patch new file mode 100644 index 0000000000..1fa5a54c70 --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2022-26691.patch | |||
@@ -0,0 +1,33 @@ | |||
1 | From de4f8c196106033e4c372dce3e91b9d42b0b9444 Mon Sep 17 00:00:00 2001 | ||
2 | From: Zdenek Dohnal <zdohnal@redhat.com> | ||
3 | Date: Thu, 26 May 2022 06:27:04 +0200 | ||
4 | Subject: [PATCH] scheduler/cert.c: Fix string comparison (fixes | ||
5 | CVE-2022-26691) | ||
6 | |||
7 | The previous algorithm didn't expect the strings can have a different | ||
8 | length, so one string can be a substring of the other and such substring | ||
9 | was reported as equal to the longer string. | ||
10 | |||
11 | CVE: CVE-2022-26691 | ||
12 | Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444] | ||
13 | Signed-off-by: Steve Sakoman | ||
14 | |||
15 | --- | ||
16 | diff --git a/scheduler/cert.c b/scheduler/cert.c | ||
17 | index b268bf1b2..9b65b96c9 100644 | ||
18 | --- a/scheduler/cert.c | ||
19 | +++ b/scheduler/cert.c | ||
20 | @@ -434,5 +434,12 @@ ctcompare(const char *a, /* I - First string */ | ||
21 | b ++; | ||
22 | } | ||
23 | |||
24 | - return (result); | ||
25 | + /* | ||
26 | + * The while loop finishes when *a == '\0' or *b == '\0' | ||
27 | + * so after the while loop either both *a and *b == '\0', | ||
28 | + * or one points inside a string, so when we apply logical OR on *a, | ||
29 | + * *b and result, we get a non-zero return value if the compared strings don't match. | ||
30 | + */ | ||
31 | + | ||
32 | + return (result | *a | *b); | ||
33 | } | ||