diff options
author | Yi Zhao <yi.zhao@windriver.com> | 2021-11-11 20:57:23 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-11-24 21:12:46 +0000 |
commit | e013219d8c0b3e52e3f52e05caf2f53927004c73 (patch) | |
tree | b5e9466ddd7813dd59f7471ff307afa520644992 /meta/recipes-connectivity/inetutils | |
parent | f5d1d23c1bc03c6d7ff7ca8b3d9de33a0ddaf4d6 (diff) | |
download | poky-e013219d8c0b3e52e3f52e05caf2f53927004c73.tar.gz |
inetutils: fix CVE-2021-40491
CVE-2021-40491:
The ftp client in GNU Inetutils before 2.2 does not validate addresses
returned by PASV/LSPV responses to make sure they match the server
address. This is similar to CVE-2020-8284 for curl.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-40491
Patch from:
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
(From OE-Core rev: 1b857807f1cf8fee3175f8479a0c7cb1850bd9a9)
drop changes to NEWS
(From OE-Core rev: 217e5f0857e0a542c4e02bbead4e91edc6eb9ecc)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/inetutils')
-rw-r--r-- | meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch | 67 | ||||
-rw-r--r-- | meta/recipes-connectivity/inetutils/inetutils_2.0.bb | 1 |
2 files changed, 68 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch b/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch new file mode 100644 index 0000000000..f05c696929 --- /dev/null +++ b/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch | |||
@@ -0,0 +1,67 @@ | |||
1 | From 98ccabf68e5b3f0a177bd1925581753d10041448 Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Josefsson <simon@josefsson.org> | ||
3 | Date: Wed, 1 Sep 2021 09:09:50 +0200 | ||
4 | Subject: [PATCH] ftp: check that PASV/LSPV addresses match. | ||
5 | |||
6 | * NEWS: Mention change. | ||
7 | * ftp/ftp.c (initconn): Validate returned addresses. | ||
8 | |||
9 | CVE: CVE-2021-40491 | ||
10 | |||
11 | Upstream-Status: Backport | ||
12 | [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd] | ||
13 | |||
14 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
15 | --- | ||
16 | ftp/ftp.c | 21 +++++++++++++++++++++ | ||
17 | 1 files changed, 21 insertions(+) | ||
18 | |||
19 | diff --git a/ftp/ftp.c b/ftp/ftp.c | ||
20 | index d21dbdd..7513539 100644 | ||
21 | --- a/ftp/ftp.c | ||
22 | +++ b/ftp/ftp.c | ||
23 | @@ -1365,6 +1365,13 @@ initconn (void) | ||
24 | uint32_t *pu32 = (uint32_t *) &data_addr_sa4->sin_addr.s_addr; | ||
25 | pu32[0] = htonl ( (h[0] << 24) | (h[1] << 16) | (h[2] << 8) | h[3]); | ||
26 | } | ||
27 | + if (data_addr_sa4->sin_addr.s_addr | ||
28 | + != ((struct sockaddr_in *) &hisctladdr)->sin_addr.s_addr) | ||
29 | + { | ||
30 | + printf ("Passive mode address mismatch.\n"); | ||
31 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
32 | + goto bad; | ||
33 | + } | ||
34 | } /* LPSV IPv4 */ | ||
35 | else /* IPv6 */ | ||
36 | { | ||
37 | @@ -1395,6 +1402,13 @@ initconn (void) | ||
38 | pu32[2] = htonl ( (h[8] << 24) | (h[9] << 16) | (h[10] << 8) | h[11]); | ||
39 | pu32[3] = htonl ( (h[12] << 24) | (h[13] << 16) | (h[14] << 8) | h[15]); | ||
40 | } | ||
41 | + if (data_addr_sa6->sin6_addr.s6_addr | ||
42 | + != ((struct sockaddr_in6 *) &hisctladdr)->sin6_addr.s6_addr) | ||
43 | + { | ||
44 | + printf ("Passive mode address mismatch.\n"); | ||
45 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
46 | + goto bad; | ||
47 | + } | ||
48 | } /* LPSV IPv6 */ | ||
49 | } | ||
50 | else /* !EPSV && !LPSV */ | ||
51 | @@ -1415,6 +1429,13 @@ initconn (void) | ||
52 | | ((a2 & 0xff) << 8) | (a3 & 0xff) ); | ||
53 | data_addr_sa4->sin_port = | ||
54 | htons (((p0 & 0xff) << 8) | (p1 & 0xff)); | ||
55 | + if (data_addr_sa4->sin_addr.s_addr | ||
56 | + != ((struct sockaddr_in *) &hisctladdr)->sin_addr.s_addr) | ||
57 | + { | ||
58 | + printf ("Passive mode address mismatch.\n"); | ||
59 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
60 | + goto bad; | ||
61 | + } | ||
62 | } /* PASV */ | ||
63 | else | ||
64 | { | ||
65 | -- | ||
66 | 2.17.1 | ||
67 | |||
diff --git a/meta/recipes-connectivity/inetutils/inetutils_2.0.bb b/meta/recipes-connectivity/inetutils/inetutils_2.0.bb index a4d05b0542..d299bc359e 100644 --- a/meta/recipes-connectivity/inetutils/inetutils_2.0.bb +++ b/meta/recipes-connectivity/inetutils/inetutils_2.0.bb | |||
@@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \ | |||
20 | file://tftpd.xinetd.inetutils \ | 20 | file://tftpd.xinetd.inetutils \ |
21 | file://inetutils-1.9-PATH_PROCNET_DEV.patch \ | 21 | file://inetutils-1.9-PATH_PROCNET_DEV.patch \ |
22 | file://inetutils-only-check-pam_appl.h-when-pam-enabled.patch \ | 22 | file://inetutils-only-check-pam_appl.h-when-pam-enabled.patch \ |
23 | file://CVE-2021-40491.patch \ | ||
23 | " | 24 | " |
24 | 25 | ||
25 | SRC_URI[md5sum] = "5e1018502cd131ed8e42339f6b5c98aa" | 26 | SRC_URI[md5sum] = "5e1018502cd131ed8e42339f6b5c98aa" |