diff options
author | Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> | 2022-01-19 19:16:58 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-01-20 11:57:29 +0000 |
commit | b129c716fc587b250cc441b8de67db2d2ec96236 (patch) | |
tree | 69d686cb067e682a8fba2d4d2ef0c16cb940f813 /meta/recipes-core/glibc/glibc | |
parent | 73ff4e0ce1b68ef00fcc5d94e1e356f7f7ba4788 (diff) | |
download | poky-b129c716fc587b250cc441b8de67db2d2ec96236.tar.gz |
glibc : Fix CVE-2022-23219
Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=226b46770c82899b555986583294b049c6ec9b40]
Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ef972a4c50014a16132b5c75571cfb6b30bef136]
(From OE-Core rev: 6ad7240c732dd63e74ac32588b92241030c194ae)
Signed-off-by: pgowda <pgowda.cve@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core/glibc/glibc')
-rw-r--r-- | meta/recipes-core/glibc/glibc/0001-CVE-2022-23219.patch | 55 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc/0002-CVE-2022-23219.patch | 89 |
2 files changed, 144 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/0001-CVE-2022-23219.patch b/meta/recipes-core/glibc/glibc/0001-CVE-2022-23219.patch new file mode 100644 index 0000000000..261c2909db --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0001-CVE-2022-23219.patch | |||
@@ -0,0 +1,55 @@ | |||
1 | From 226b46770c82899b555986583294b049c6ec9b40 Mon Sep 17 00:00:00 2001 | ||
2 | From: Florian Weimer <fweimer@redhat.com> | ||
3 | Date: Mon, 17 Jan 2022 10:21:34 +0100 | ||
4 | Subject: [PATCH] CVE-2022-23219: Buffer overflow in sunrpc clnt_create for | ||
5 | "unix" (bug 22542) | ||
6 | |||
7 | Processing an overlong pathname in the sunrpc clnt_create function | ||
8 | results in a stack-based buffer overflow. | ||
9 | |||
10 | Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=226b46770c82899b555986583294b049c6ec9b40] | ||
11 | CVE: CVE-2022-23219 | ||
12 | |||
13 | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> | ||
14 | Signed-off-by: Pgowda <pgowda.cve@gmail.com> | ||
15 | --- | ||
16 | NEWS | 4 +++- | ||
17 | sunrpc/clnt_gen.c | 10 +++++++--- | ||
18 | 2 files changed, 10 insertions(+), 4 deletions(-) | ||
19 | |||
20 | diff --git a/NEWS b/NEWS | ||
21 | index ddd95a8329..38a9ddb2cf 100644 | ||
22 | --- a/NEWS | ||
23 | +++ b/NEWS | ||
24 | @@ -206,6 +206,10 @@ Security related changes: | ||
25 | CVE-2022-23218: Passing an overlong file name to the svcunix_create | ||
26 | legacy function could result in a stack-based buffer overflow. | ||
27 | |||
28 | + CVE-2022-23219: Passing an overlong file name to the clnt_create | ||
29 | + legacy function could result in a stack-based buffer overflow when | ||
30 | + using the "unix" protocol. Reported by Martin Sebor. | ||
31 | + | ||
32 | The following bugs are resolved with this release: | ||
33 | |||
34 | [4737] libc: fork is not async-signal-safe | ||
35 | diff --git a/sunrpc/clnt_gen.c b/sunrpc/clnt_gen.c | ||
36 | index 13ced8994e..b44357cd88 100644 | ||
37 | --- a/sunrpc/clnt_gen.c | ||
38 | +++ b/sunrpc/clnt_gen.c | ||
39 | @@ -57,9 +57,13 @@ clnt_create (const char *hostname, u_lon | ||
40 | |||
41 | if (strcmp (proto, "unix") == 0) | ||
42 | { | ||
43 | - memset ((char *)&sun, 0, sizeof (sun)); | ||
44 | - sun.sun_family = AF_UNIX; | ||
45 | - strcpy (sun.sun_path, hostname); | ||
46 | + if (__sockaddr_un_set (&sun, hostname) < 0) | ||
47 | + { | ||
48 | + struct rpc_createerr *ce = &get_rpc_createerr (); | ||
49 | + ce->cf_stat = RPC_SYSTEMERROR; | ||
50 | + ce->cf_error.re_errno = errno; | ||
51 | + return NULL; | ||
52 | + } | ||
53 | sock = RPC_ANYSOCK; | ||
54 | client = clntunix_create (&sun, prog, vers, &sock, 0, 0); | ||
55 | if (client == NULL) | ||
diff --git a/meta/recipes-core/glibc/glibc/0002-CVE-2022-23219.patch b/meta/recipes-core/glibc/glibc/0002-CVE-2022-23219.patch new file mode 100644 index 0000000000..6779e9afdf --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0002-CVE-2022-23219.patch | |||
@@ -0,0 +1,89 @@ | |||
1 | From ef972a4c50014a16132b5c75571cfb6b30bef136 Mon Sep 17 00:00:00 2001 | ||
2 | From: Martin Sebor <msebor@redhat.com> | ||
3 | Date: Mon, 17 Jan 2022 10:21:34 +0100 | ||
4 | Subject: [PATCH] sunrpc: Test case for clnt_create "unix" buffer overflow (bug | ||
5 | 22542) | ||
6 | |||
7 | Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ef972a4c50014a16132b5c75571cfb6b30bef136] | ||
8 | CVE: CVE-2022-23219 | ||
9 | |||
10 | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> | ||
11 | Signed-off-by: Pgowda <pgowda.cve@gmail.com> | ||
12 | --- | ||
13 | sunrpc/Makefile | 5 ++++- | ||
14 | sunrpc/tst-bug22542.c | 44 +++++++++++++++++++++++++++++++++++++++++++ | ||
15 | 2 files changed, 48 insertions(+), 1 deletion(-) | ||
16 | create mode 100644 sunrpc/tst-bug22542.c | ||
17 | |||
18 | diff --git a/sunrpc/Makefile b/sunrpc/Makefile | ||
19 | index 9a31fe48b9..183ef3dc55 100644 | ||
20 | --- a/sunrpc/Makefile | ||
21 | +++ b/sunrpc/Makefile | ||
22 | @@ -65,7 +65,7 @@ shared-only-routines = $(routines) | ||
23 | endif | ||
24 | |||
25 | tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \ | ||
26 | - tst-udp-nonblocking tst-bug28768 | ||
27 | + tst-udp-nonblocking tst-bug22542 tst-bug28768 | ||
28 | xtests := tst-getmyaddr | ||
29 | |||
30 | ifeq ($(have-thread-library),yes) | ||
31 | @@ -110,6 +110,8 @@ $(objpfx)tst-udp-nonblocking: $(common-o | ||
32 | $(objpfx)tst-udp-garbage: \ | ||
33 | $(common-objpfx)linkobj/libc.so $(shared-thread-library) | ||
34 | |||
35 | +$(objpfx)tst-bug22542: $(common-objpfx)linkobj/libc.so | ||
36 | + | ||
37 | else # !have-GLIBC_2.31 | ||
38 | |||
39 | routines = $(routines-for-nss) | ||
40 | diff --git a/sunrpc/tst-bug22542.c b/sunrpc/tst-bug22542.c | ||
41 | new file mode 100644 | ||
42 | index 0000000000..d6cd79787b | ||
43 | --- /dev/null | ||
44 | +++ b/sunrpc/tst-bug22542.c | ||
45 | @@ -0,0 +1,44 @@ | ||
46 | +/* Test to verify that overlong hostname is rejected by clnt_create | ||
47 | + and doesn't cause a buffer overflow (bug 22542). | ||
48 | + | ||
49 | + Copyright (C) 2022 Free Software Foundation, Inc. | ||
50 | + This file is part of the GNU C Library. | ||
51 | + | ||
52 | + The GNU C Library is free software; you can redistribute it and/or | ||
53 | + modify it under the terms of the GNU Lesser General Public | ||
54 | + License as published by the Free Software Foundation; either | ||
55 | + version 2.1 of the License, or (at your option) any later version. | ||
56 | + | ||
57 | + The GNU C Library is distributed in the hope that it will be useful, | ||
58 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
59 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
60 | + Lesser General Public License for more details. | ||
61 | + | ||
62 | + You should have received a copy of the GNU Lesser General Public | ||
63 | + License along with the GNU C Library; if not, see | ||
64 | + <http://www.gnu.org/licenses/>. */ | ||
65 | + | ||
66 | +#include <errno.h> | ||
67 | +#include <rpc/clnt.h> | ||
68 | +#include <string.h> | ||
69 | +#include <support/check.h> | ||
70 | +#include <sys/socket.h> | ||
71 | +#include <sys/un.h> | ||
72 | + | ||
73 | +static int | ||
74 | +do_test (void) | ||
75 | +{ | ||
76 | + /* Create an arbitrary hostname that's longer than fits in sun_path. */ | ||
77 | + char name [sizeof ((struct sockaddr_un*)0)->sun_path * 2]; | ||
78 | + memset (name, 'x', sizeof name - 1); | ||
79 | + name [sizeof name - 1] = '\0'; | ||
80 | + | ||
81 | + errno = 0; | ||
82 | + CLIENT *clnt = clnt_create (name, 0, 0, "unix"); | ||
83 | + | ||
84 | + TEST_VERIFY (clnt == NULL); | ||
85 | + TEST_COMPARE (errno, EINVAL); | ||
86 | + return 0; | ||
87 | +} | ||
88 | + | ||
89 | +#include <support/test-driver.c> | ||