diff options
author | Steve Sakoman <steve@sakoman.com> | 2021-07-21 07:12:14 -1000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-08-10 11:14:10 +0100 |
commit | f30d69e51f475773bf8e05a7ed328b9f908879b7 (patch) | |
tree | 1ee852a17ab5e6a156995dc3c6f50f9e79393f06 /meta/recipes-core/libxml | |
parent | 4542e5f944051c56235930a8a457a473026fa219 (diff) | |
download | poky-f30d69e51f475773bf8e05a7ed328b9f908879b7.tar.gz |
libxml2: fix CVE-2021-3541
A flaw was found in libxml2. Exponential entity expansion attack
is possible bypassing all existing protection mechanisms and leading
to denial of service.
https://nvd.nist.gov/vuln/detail/CVE-2021-3541
CVE: 2021-3541
(From OE-Core rev: 1699293a7011797895c284d6ad664c66badba426)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core/libxml')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2021-3541.patch | 73 | ||||
-rw-r--r-- | meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 |
2 files changed, 74 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2021-3541.patch b/meta/recipes-core/libxml/libxml2/CVE-2021-3541.patch new file mode 100644 index 0000000000..1f392b4cd7 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2021-3541.patch | |||
@@ -0,0 +1,73 @@ | |||
1 | From 8598060bacada41a0eb09d95c97744ff4e428f8e Mon Sep 17 00:00:00 2001 | ||
2 | From: Daniel Veillard <veillard@redhat.com> | ||
3 | Date: Thu, 13 May 2021 14:55:12 +0200 | ||
4 | Subject: [PATCH] Patch for security issue CVE-2021-3541 | ||
5 | |||
6 | This is relapted to parameter entities expansion and following | ||
7 | the line of the billion laugh attack. Somehow in that path the | ||
8 | counting of parameters was missed and the normal algorithm based | ||
9 | on entities "density" was useless. | ||
10 | |||
11 | Upstream-Status: Backport | ||
12 | [https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e] | ||
13 | CVE: CVE-2021-3541 | ||
14 | Signed-off-by: Steve Sakoman <steve@sakoman.com> | ||
15 | |||
16 | --- | ||
17 | parser.c | 26 ++++++++++++++++++++++++++ | ||
18 | 1 file changed, 26 insertions(+) | ||
19 | |||
20 | diff --git a/parser.c b/parser.c | ||
21 | index f5e5e169..c9312fa4 100644 | ||
22 | --- a/parser.c | ||
23 | +++ b/parser.c | ||
24 | @@ -140,6 +140,7 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, | ||
25 | xmlEntityPtr ent, size_t replacement) | ||
26 | { | ||
27 | size_t consumed = 0; | ||
28 | + int i; | ||
29 | |||
30 | if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE)) | ||
31 | return (0); | ||
32 | @@ -177,6 +178,28 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, | ||
33 | rep = NULL; | ||
34 | } | ||
35 | } | ||
36 | + | ||
37 | + /* | ||
38 | + * Prevent entity exponential check, not just replacement while | ||
39 | + * parsing the DTD | ||
40 | + * The check is potentially costly so do that only once in a thousand | ||
41 | + */ | ||
42 | + if ((ctxt->instate == XML_PARSER_DTD) && (ctxt->nbentities > 10000) && | ||
43 | + (ctxt->nbentities % 1024 == 0)) { | ||
44 | + for (i = 0;i < ctxt->inputNr;i++) { | ||
45 | + consumed += ctxt->inputTab[i]->consumed + | ||
46 | + (ctxt->inputTab[i]->cur - ctxt->inputTab[i]->base); | ||
47 | + } | ||
48 | + if (ctxt->nbentities > consumed * XML_PARSER_NON_LINEAR) { | ||
49 | + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); | ||
50 | + ctxt->instate = XML_PARSER_EOF; | ||
51 | + return (1); | ||
52 | + } | ||
53 | + consumed = 0; | ||
54 | + } | ||
55 | + | ||
56 | + | ||
57 | + | ||
58 | if (replacement != 0) { | ||
59 | if (replacement < XML_MAX_TEXT_LENGTH) | ||
60 | return(0); | ||
61 | @@ -7963,6 +7986,9 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt) | ||
62 | xmlChar start[4]; | ||
63 | xmlCharEncoding enc; | ||
64 | |||
65 | + if (xmlParserEntityCheck(ctxt, 0, entity, 0)) | ||
66 | + return; | ||
67 | + | ||
68 | if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && | ||
69 | ((ctxt->options & XML_PARSE_NOENT) == 0) && | ||
70 | ((ctxt->options & XML_PARSE_DTDVALID) == 0) && | ||
71 | -- | ||
72 | GitLab | ||
73 | |||
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb index b5fb3e6315..60dc71f38d 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb | |||
@@ -26,6 +26,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \ | |||
26 | file://CVE-2021-3517.patch \ | 26 | file://CVE-2021-3517.patch \ |
27 | file://CVE-2021-3537.patch \ | 27 | file://CVE-2021-3537.patch \ |
28 | file://CVE-2021-3518.patch \ | 28 | file://CVE-2021-3518.patch \ |
29 | file://CVE-2021-3541.patch \ | ||
29 | " | 30 | " |
30 | 31 | ||
31 | SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" | 32 | SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" |