diff options
author | Armin Kuster <akuster@mvista.com> | 2016-02-23 17:38:25 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2016-03-03 11:11:40 +0000 |
commit | f98b8b767d66e0e4bfa6f3e8ef7e44a4d45270e3 (patch) | |
tree | eaf1e0b535b1f650b15c25daef6fb3274ccedb58 /meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch | |
parent | 3aa8ba185b381088f4c51d7ba48fb109f2fc679b (diff) | |
download | poky-f98b8b767d66e0e4bfa6f3e8ef7e44a4d45270e3.tar.gz |
git: Security fixes CVE-2015-7545
CVE-2015-7545 git: arbitrary code execution via crafted URLs
(From OE-Core rev: 0c4bdd61acbc1fa1b9bfb167d8eaf90c8bccc25c)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Already in Jethro, not needed in master due to shipping a version of git
which is already fixes (> 2.6.1)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch')
-rw-r--r-- | meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch | 445 |
1 files changed, 445 insertions, 0 deletions
diff --git a/meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch b/meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch new file mode 100644 index 0000000000..6bea2268dc --- /dev/null +++ b/meta/recipes-devtools/git/git-2.3.0/CVE-2015-7545_1.patch | |||
@@ -0,0 +1,445 @@ | |||
1 | From a5adaced2e13c135d5d9cc65be9eb95aa3bacedf Mon Sep 17 00:00:00 2001 | ||
2 | From: Jeff King <peff@peff.net> | ||
3 | Date: Wed, 16 Sep 2015 13:12:52 -0400 | ||
4 | Subject: [PATCH] transport: add a protocol-whitelist environment variable | ||
5 | |||
6 | If we are cloning an untrusted remote repository into a | ||
7 | sandbox, we may also want to fetch remote submodules in | ||
8 | order to get the complete view as intended by the other | ||
9 | side. However, that opens us up to attacks where a malicious | ||
10 | user gets us to clone something they would not otherwise | ||
11 | have access to (this is not necessarily a problem by itself, | ||
12 | but we may then act on the cloned contents in a way that | ||
13 | exposes them to the attacker). | ||
14 | |||
15 | Ideally such a setup would sandbox git entirely away from | ||
16 | high-value items, but this is not always practical or easy | ||
17 | to set up (e.g., OS network controls may block multiple | ||
18 | protocols, and we would want to enable some but not others). | ||
19 | |||
20 | We can help this case by providing a way to restrict | ||
21 | particular protocols. We use a whitelist in the environment. | ||
22 | This is more annoying to set up than a blacklist, but | ||
23 | defaults to safety if the set of protocols git supports | ||
24 | grows). If no whitelist is specified, we continue to default | ||
25 | to allowing all protocols (this is an "unsafe" default, but | ||
26 | since the minority of users will want this sandboxing | ||
27 | effect, it is the only sensible one). | ||
28 | |||
29 | A note on the tests: ideally these would all be in a single | ||
30 | test file, but the git-daemon and httpd test infrastructure | ||
31 | is an all-or-nothing proposition rather than a test-by-test | ||
32 | prerequisite. By putting them all together, we would be | ||
33 | unable to test the file-local code on machines without | ||
34 | apache. | ||
35 | |||
36 | Signed-off-by: Jeff King <peff@peff.net> | ||
37 | Signed-off-by: Junio C Hamano <gitster@pobox.com> | ||
38 | |||
39 | Upstream-Status: Backport | ||
40 | /hom://kernel.googlesource.com/pub/scm/git/git/+/a5adaced2e13c135d5d9cc65be9eb95aa3bacedf%5E%21/ | ||
41 | CVE: CVE-2015-7545 patch #1 | ||
42 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
43 | |||
44 | --- | ||
45 | Documentation/git.txt | 32 ++++++++++++++ | ||
46 | connect.c | 5 +++ | ||
47 | t/lib-proto-disable.sh | 96 ++++++++++++++++++++++++++++++++++++++++++ | ||
48 | t/t5810-proto-disable-local.sh | 14 ++++++ | ||
49 | t/t5811-proto-disable-git.sh | 20 +++++++++ | ||
50 | t/t5812-proto-disable-http.sh | 20 +++++++++ | ||
51 | t/t5813-proto-disable-ssh.sh | 20 +++++++++ | ||
52 | t/t5814-proto-disable-ext.sh | 18 ++++++++ | ||
53 | transport-helper.c | 2 + | ||
54 | transport.c | 21 ++++++++- | ||
55 | transport.h | 7 +++ | ||
56 | 11 files changed, 254 insertions(+), 1 deletion(-) | ||
57 | create mode 100644 t/lib-proto-disable.sh | ||
58 | create mode 100755 t/t5810-proto-disable-local.sh | ||
59 | create mode 100755 t/t5811-proto-disable-git.sh | ||
60 | create mode 100755 t/t5812-proto-disable-http.sh | ||
61 | create mode 100755 t/t5813-proto-disable-ssh.sh | ||
62 | create mode 100755 t/t5814-proto-disable-ext.sh | ||
63 | |||
64 | Index: git-2.3.0/Documentation/git.txt | ||
65 | =================================================================== | ||
66 | --- git-2.3.0.orig/Documentation/git.txt | ||
67 | +++ git-2.3.0/Documentation/git.txt | ||
68 | @@ -1023,6 +1023,38 @@ GIT_ICASE_PATHSPECS:: | ||
69 | variable when it is invoked as the top level command by the | ||
70 | end user, to be recorded in the body of the reflog. | ||
71 | |||
72 | +`GIT_ALLOW_PROTOCOL`:: | ||
73 | + If set, provide a colon-separated list of protocols which are | ||
74 | + allowed to be used with fetch/push/clone. This is useful to | ||
75 | + restrict recursive submodule initialization from an untrusted | ||
76 | + repository. Any protocol not mentioned will be disallowed (i.e., | ||
77 | + this is a whitelist, not a blacklist). If the variable is not | ||
78 | + set at all, all protocols are enabled. The protocol names | ||
79 | + currently used by git are: | ||
80 | + | ||
81 | + - `file`: any local file-based path (including `file://` URLs, | ||
82 | + or local paths) | ||
83 | + | ||
84 | + - `git`: the anonymous git protocol over a direct TCP | ||
85 | + connection (or proxy, if configured) | ||
86 | + | ||
87 | + - `ssh`: git over ssh (including `host:path` syntax, | ||
88 | + `git+ssh://`, etc). | ||
89 | + | ||
90 | + - `rsync`: git over rsync | ||
91 | + | ||
92 | + - `http`: git over http, both "smart http" and "dumb http". | ||
93 | + Note that this does _not_ include `https`; if you want both, | ||
94 | + you should specify both as `http:https`. | ||
95 | + | ||
96 | + - any external helpers are named by their protocol (e.g., use | ||
97 | + `hg` to allow the `git-remote-hg` helper) | ||
98 | ++ | ||
99 | +Note that this controls only git's internal protocol selection. | ||
100 | +If libcurl is used (e.g., by the `http` transport), it may | ||
101 | +redirect to other protocols. There is not currently any way to | ||
102 | +restrict this. | ||
103 | + | ||
104 | |||
105 | Discussion[[Discussion]] | ||
106 | ------------------------ | ||
107 | Index: git-2.3.0/connect.c | ||
108 | =================================================================== | ||
109 | --- git-2.3.0.orig/connect.c | ||
110 | +++ git-2.3.0/connect.c | ||
111 | @@ -9,6 +9,7 @@ | ||
112 | #include "url.h" | ||
113 | #include "string-list.h" | ||
114 | #include "sha1-array.h" | ||
115 | +#include "transport.h" | ||
116 | |||
117 | static char *server_capabilities; | ||
118 | static const char *parse_feature_value(const char *, const char *, int *); | ||
119 | @@ -674,6 +675,9 @@ struct child_process *git_connect(int fd | ||
120 | * cannot connect. | ||
121 | */ | ||
122 | char *target_host = xstrdup(hostandport); | ||
123 | + | ||
124 | + transport_check_allowed("git"); | ||
125 | + | ||
126 | if (git_use_proxy(hostandport)) | ||
127 | conn = git_proxy_connect(fd, hostandport); | ||
128 | else | ||
129 | @@ -704,6 +708,7 @@ struct child_process *git_connect(int fd | ||
130 | int putty; | ||
131 | char *ssh_host = hostandport; | ||
132 | const char *port = NULL; | ||
133 | + transport_check_allowed("ssh"); | ||
134 | get_host_and_port(&ssh_host, &port); | ||
135 | port = get_port_numeric(port); | ||
136 | |||
137 | @@ -731,6 +736,7 @@ struct child_process *git_connect(int fd | ||
138 | /* remove repo-local variables from the environment */ | ||
139 | conn->env = local_repo_env; | ||
140 | conn->use_shell = 1; | ||
141 | + transport_check_allowed("file"); | ||
142 | } | ||
143 | argv_array_push(&conn->args, cmd.buf); | ||
144 | |||
145 | Index: git-2.3.0/t/lib-proto-disable.sh | ||
146 | =================================================================== | ||
147 | --- /dev/null | ||
148 | +++ git-2.3.0/t/lib-proto-disable.sh | ||
149 | @@ -0,0 +1,96 @@ | ||
150 | +# Test routines for checking protocol disabling. | ||
151 | + | ||
152 | +# test cloning a particular protocol | ||
153 | +# $1 - description of the protocol | ||
154 | +# $2 - machine-readable name of the protocol | ||
155 | +# $3 - the URL to try cloning | ||
156 | +test_proto () { | ||
157 | + desc=$1 | ||
158 | + proto=$2 | ||
159 | + url=$3 | ||
160 | + | ||
161 | + test_expect_success "clone $1 (enabled)" ' | ||
162 | + rm -rf tmp.git && | ||
163 | + ( | ||
164 | + GIT_ALLOW_PROTOCOL=$proto && | ||
165 | + export GIT_ALLOW_PROTOCOL && | ||
166 | + git clone --bare "$url" tmp.git | ||
167 | + ) | ||
168 | + ' | ||
169 | + | ||
170 | + test_expect_success "fetch $1 (enabled)" ' | ||
171 | + ( | ||
172 | + cd tmp.git && | ||
173 | + GIT_ALLOW_PROTOCOL=$proto && | ||
174 | + export GIT_ALLOW_PROTOCOL && | ||
175 | + git fetch | ||
176 | + ) | ||
177 | + ' | ||
178 | + | ||
179 | + test_expect_success "push $1 (enabled)" ' | ||
180 | + ( | ||
181 | + cd tmp.git && | ||
182 | + GIT_ALLOW_PROTOCOL=$proto && | ||
183 | + export GIT_ALLOW_PROTOCOL && | ||
184 | + git push origin HEAD:pushed | ||
185 | + ) | ||
186 | + ' | ||
187 | + | ||
188 | + test_expect_success "push $1 (disabled)" ' | ||
189 | + ( | ||
190 | + cd tmp.git && | ||
191 | + GIT_ALLOW_PROTOCOL=none && | ||
192 | + export GIT_ALLOW_PROTOCOL && | ||
193 | + test_must_fail git push origin HEAD:pushed | ||
194 | + ) | ||
195 | + ' | ||
196 | + | ||
197 | + test_expect_success "fetch $1 (disabled)" ' | ||
198 | + ( | ||
199 | + cd tmp.git && | ||
200 | + GIT_ALLOW_PROTOCOL=none && | ||
201 | + export GIT_ALLOW_PROTOCOL && | ||
202 | + test_must_fail git fetch | ||
203 | + ) | ||
204 | + ' | ||
205 | + | ||
206 | + test_expect_success "clone $1 (disabled)" ' | ||
207 | + rm -rf tmp.git && | ||
208 | + ( | ||
209 | + GIT_ALLOW_PROTOCOL=none && | ||
210 | + export GIT_ALLOW_PROTOCOL && | ||
211 | + test_must_fail git clone --bare "$url" tmp.git | ||
212 | + ) | ||
213 | + ' | ||
214 | +} | ||
215 | + | ||
216 | +# set up an ssh wrapper that will access $host/$repo in the | ||
217 | +# trash directory, and enable it for subsequent tests. | ||
218 | +setup_ssh_wrapper () { | ||
219 | + test_expect_success 'setup ssh wrapper' ' | ||
220 | + write_script ssh-wrapper <<-\EOF && | ||
221 | + echo >&2 "ssh: $*" | ||
222 | + host=$1; shift | ||
223 | + cd "$TRASH_DIRECTORY/$host" && | ||
224 | + eval "$*" | ||
225 | + EOF | ||
226 | + GIT_SSH="$PWD/ssh-wrapper" && | ||
227 | + export GIT_SSH && | ||
228 | + export TRASH_DIRECTORY | ||
229 | + ' | ||
230 | +} | ||
231 | + | ||
232 | +# set up a wrapper that can be used with remote-ext to | ||
233 | +# access repositories in the "remote" directory of trash-dir, | ||
234 | +# like "ext::fake-remote %S repo.git" | ||
235 | +setup_ext_wrapper () { | ||
236 | + test_expect_success 'setup ext wrapper' ' | ||
237 | + write_script fake-remote <<-\EOF && | ||
238 | + echo >&2 "fake-remote: $*" | ||
239 | + cd "$TRASH_DIRECTORY/remote" && | ||
240 | + eval "$*" | ||
241 | + EOF | ||
242 | + PATH=$TRASH_DIRECTORY:$PATH && | ||
243 | + export TRASH_DIRECTORY | ||
244 | + ' | ||
245 | +} | ||
246 | Index: git-2.3.0/t/t5810-proto-disable-local.sh | ||
247 | =================================================================== | ||
248 | --- /dev/null | ||
249 | +++ git-2.3.0/t/t5810-proto-disable-local.sh | ||
250 | @@ -0,0 +1,14 @@ | ||
251 | +#!/bin/sh | ||
252 | + | ||
253 | +test_description='test disabling of local paths in clone/fetch' | ||
254 | +. ./test-lib.sh | ||
255 | +. "$TEST_DIRECTORY/lib-proto-disable.sh" | ||
256 | + | ||
257 | +test_expect_success 'setup repository to clone' ' | ||
258 | + test_commit one | ||
259 | +' | ||
260 | + | ||
261 | +test_proto "file://" file "file://$PWD" | ||
262 | +test_proto "path" file . | ||
263 | + | ||
264 | +test_done | ||
265 | Index: git-2.3.0/t/t5811-proto-disable-git.sh | ||
266 | =================================================================== | ||
267 | --- /dev/null | ||
268 | +++ git-2.3.0/t/t5811-proto-disable-git.sh | ||
269 | @@ -0,0 +1,20 @@ | ||
270 | +#!/bin/sh | ||
271 | + | ||
272 | +test_description='test disabling of git-over-tcp in clone/fetch' | ||
273 | +. ./test-lib.sh | ||
274 | +. "$TEST_DIRECTORY/lib-proto-disable.sh" | ||
275 | +. "$TEST_DIRECTORY/lib-git-daemon.sh" | ||
276 | +start_git_daemon | ||
277 | + | ||
278 | +test_expect_success 'create git-accessible repo' ' | ||
279 | + bare="$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" && | ||
280 | + test_commit one && | ||
281 | + git --bare init "$bare" && | ||
282 | + git push "$bare" HEAD && | ||
283 | + >"$bare/git-daemon-export-ok" && | ||
284 | + git -C "$bare" config daemon.receivepack true | ||
285 | +' | ||
286 | + | ||
287 | +test_proto "git://" git "$GIT_DAEMON_URL/repo.git" | ||
288 | + | ||
289 | +test_done | ||
290 | Index: git-2.3.0/t/t5812-proto-disable-http.sh | ||
291 | =================================================================== | ||
292 | --- /dev/null | ||
293 | +++ git-2.3.0/t/t5812-proto-disable-http.sh | ||
294 | @@ -0,0 +1,20 @@ | ||
295 | +#!/bin/sh | ||
296 | + | ||
297 | +test_description='test disabling of git-over-http in clone/fetch' | ||
298 | +. ./test-lib.sh | ||
299 | +. "$TEST_DIRECTORY/lib-proto-disable.sh" | ||
300 | +. "$TEST_DIRECTORY/lib-httpd.sh" | ||
301 | +start_httpd | ||
302 | + | ||
303 | +test_expect_success 'create git-accessible repo' ' | ||
304 | + bare="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" && | ||
305 | + test_commit one && | ||
306 | + git --bare init "$bare" && | ||
307 | + git push "$bare" HEAD && | ||
308 | + git -C "$bare" config http.receivepack true | ||
309 | +' | ||
310 | + | ||
311 | +test_proto "smart http" http "$HTTPD_URL/smart/repo.git" | ||
312 | + | ||
313 | +stop_httpd | ||
314 | +test_done | ||
315 | Index: git-2.3.0/t/t5813-proto-disable-ssh.sh | ||
316 | =================================================================== | ||
317 | --- /dev/null | ||
318 | +++ git-2.3.0/t/t5813-proto-disable-ssh.sh | ||
319 | @@ -0,0 +1,20 @@ | ||
320 | +#!/bin/sh | ||
321 | + | ||
322 | +test_description='test disabling of git-over-ssh in clone/fetch' | ||
323 | +. ./test-lib.sh | ||
324 | +. "$TEST_DIRECTORY/lib-proto-disable.sh" | ||
325 | + | ||
326 | +setup_ssh_wrapper | ||
327 | + | ||
328 | +test_expect_success 'setup repository to clone' ' | ||
329 | + test_commit one && | ||
330 | + mkdir remote && | ||
331 | + git init --bare remote/repo.git && | ||
332 | + git push remote/repo.git HEAD | ||
333 | +' | ||
334 | + | ||
335 | +test_proto "host:path" ssh "remote:repo.git" | ||
336 | +test_proto "ssh://" ssh "ssh://remote/$PWD/remote/repo.git" | ||
337 | +test_proto "git+ssh://" ssh "git+ssh://remote/$PWD/remote/repo.git" | ||
338 | + | ||
339 | +test_done | ||
340 | Index: git-2.3.0/t/t5814-proto-disable-ext.sh | ||
341 | =================================================================== | ||
342 | --- /dev/null | ||
343 | +++ git-2.3.0/t/t5814-proto-disable-ext.sh | ||
344 | @@ -0,0 +1,18 @@ | ||
345 | +#!/bin/sh | ||
346 | + | ||
347 | +test_description='test disabling of remote-helper paths in clone/fetch' | ||
348 | +. ./test-lib.sh | ||
349 | +. "$TEST_DIRECTORY/lib-proto-disable.sh" | ||
350 | + | ||
351 | +setup_ext_wrapper | ||
352 | + | ||
353 | +test_expect_success 'setup repository to clone' ' | ||
354 | + test_commit one && | ||
355 | + mkdir remote && | ||
356 | + git init --bare remote/repo.git && | ||
357 | + git push remote/repo.git HEAD | ||
358 | +' | ||
359 | + | ||
360 | +test_proto "remote-helper" ext "ext::fake-remote %S repo.git" | ||
361 | + | ||
362 | +test_done | ||
363 | Index: git-2.3.0/transport-helper.c | ||
364 | =================================================================== | ||
365 | --- git-2.3.0.orig/transport-helper.c | ||
366 | +++ git-2.3.0/transport-helper.c | ||
367 | @@ -1036,6 +1036,8 @@ int transport_helper_init(struct transpo | ||
368 | struct helper_data *data = xcalloc(1, sizeof(*data)); | ||
369 | data->name = name; | ||
370 | |||
371 | + transport_check_allowed(name); | ||
372 | + | ||
373 | if (getenv("GIT_TRANSPORT_HELPER_DEBUG")) | ||
374 | debug = 1; | ||
375 | |||
376 | Index: git-2.3.0/transport.c | ||
377 | =================================================================== | ||
378 | --- git-2.3.0.orig/transport.c | ||
379 | +++ git-2.3.0/transport.c | ||
380 | @@ -907,6 +907,20 @@ static int external_specification_len(co | ||
381 | return strchr(url, ':') - url; | ||
382 | } | ||
383 | |||
384 | +void transport_check_allowed(const char *type) | ||
385 | +{ | ||
386 | + struct string_list allowed = STRING_LIST_INIT_DUP; | ||
387 | + const char *v = getenv("GIT_ALLOW_PROTOCOL"); | ||
388 | + | ||
389 | + if (!v) | ||
390 | + return; | ||
391 | + | ||
392 | + string_list_split(&allowed, v, ':', -1); | ||
393 | + if (!unsorted_string_list_has_string(&allowed, type)) | ||
394 | + die("transport '%s' not allowed", type); | ||
395 | + string_list_clear(&allowed, 0); | ||
396 | +} | ||
397 | + | ||
398 | struct transport *transport_get(struct remote *remote, const char *url) | ||
399 | { | ||
400 | const char *helper; | ||
401 | @@ -938,12 +952,14 @@ struct transport *transport_get(struct r | ||
402 | if (helper) { | ||
403 | transport_helper_init(ret, helper); | ||
404 | } else if (starts_with(url, "rsync:")) { | ||
405 | + transport_check_allowed("rsync"); | ||
406 | ret->get_refs_list = get_refs_via_rsync; | ||
407 | ret->fetch = fetch_objs_via_rsync; | ||
408 | ret->push = rsync_transport_push; | ||
409 | ret->smart_options = NULL; | ||
410 | } else if (url_is_local_not_ssh(url) && is_file(url) && is_bundle(url, 1)) { | ||
411 | struct bundle_transport_data *data = xcalloc(1, sizeof(*data)); | ||
412 | + transport_check_allowed("file"); | ||
413 | ret->data = data; | ||
414 | ret->get_refs_list = get_refs_from_bundle; | ||
415 | ret->fetch = fetch_refs_from_bundle; | ||
416 | @@ -955,7 +971,10 @@ struct transport *transport_get(struct r | ||
417 | || starts_with(url, "ssh://") | ||
418 | || starts_with(url, "git+ssh://") | ||
419 | || starts_with(url, "ssh+git://")) { | ||
420 | - /* These are builtin smart transports. */ | ||
421 | + /* | ||
422 | + * These are builtin smart transports; "allowed" transports | ||
423 | + * will be checked individually in git_connect. | ||
424 | + */ | ||
425 | struct git_transport_data *data = xcalloc(1, sizeof(*data)); | ||
426 | ret->data = data; | ||
427 | ret->set_option = NULL; | ||
428 | Index: git-2.3.0/transport.h | ||
429 | =================================================================== | ||
430 | --- git-2.3.0.orig/transport.h | ||
431 | +++ git-2.3.0/transport.h | ||
432 | @@ -132,6 +132,13 @@ struct transport { | ||
433 | /* Returns a transport suitable for the url */ | ||
434 | struct transport *transport_get(struct remote *, const char *); | ||
435 | |||
436 | +/* | ||
437 | + * Check whether a transport is allowed by the environment, | ||
438 | + * and die otherwise. type should generally be the URL scheme, | ||
439 | + * as described in Documentation/git.txt | ||
440 | + */ | ||
441 | +void transport_check_allowed(const char *type); | ||
442 | + | ||
443 | /* Transport options which apply to git:// and scp-style URLs */ | ||
444 | |||
445 | /* The program to use on the remote side to send a pack */ | ||