diff options
author | Catalin Popeanga <Catalin.Popeanga@enea.com> | 2014-10-09 14:25:15 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2014-10-10 18:06:09 +0100 |
commit | bda51ee7821de9120f6f536fcabe592f2a0c8a37 (patch) | |
tree | 4ad51fa0d04af6e6ecff167c90cf46d8f13dbd13 /meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch | |
parent | 5dd12beccd4a8fb62836247171b112dfa334f8df (diff) | |
download | poky-bda51ee7821de9120f6f536fcabe592f2a0c8a37.tar.gz |
bash: Fix-for-CVE-2014-6278
This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
(From OE-Core rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)
Signed-off-by: Catalin Popeanga <Catalin.Popeanga@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch')
-rw-r--r-- | meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch | 99 |
1 files changed, 99 insertions, 0 deletions
diff --git a/meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch b/meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch new file mode 100644 index 0000000000..e51ce05bb5 --- /dev/null +++ b/meta/recipes-extended/bash/bash-3.2.48/cve-2014-6278.patch | |||
@@ -0,0 +1,99 @@ | |||
1 | bash: Fix CVE-2014-6278 (shellshock) | ||
2 | |||
3 | Upstream-status: backport | ||
4 | |||
5 | Downloaded from: | ||
6 | ftp://ftp.gnu.org/pub/bash/bash-3.2-patches/bash32-057 | ||
7 | |||
8 | Author: Chet Ramey <chet.ramey@case.edu> | ||
9 | Signed-off-by: Catalin Popeanga <catalin.popeanga@enea.com> | ||
10 | |||
11 | BASH PATCH REPORT | ||
12 | ================= | ||
13 | |||
14 | Bash-Release: 3.2 | ||
15 | Patch-ID: bash32-057 | ||
16 | |||
17 | Bug-Reported-by: Michal Zalewski <lcamtuf@coredump.cx> | ||
18 | Bug-Reference-ID: | ||
19 | Bug-Reference-URL: | ||
20 | |||
21 | Bug-Description: | ||
22 | |||
23 | A combination of nested command substitutions and function importing from | ||
24 | the environment can cause bash to execute code appearing in the environment | ||
25 | variable value following the function definition. | ||
26 | |||
27 | --- a/builtins/evalstring.c 2014-09-16 19:08:02.000000000 -0400 | ||
28 | +++ b/builtins/evalstring.c 2014-10-04 15:58:35.000000000 -0400 | ||
29 | @@ -44,4 +44,5 @@ | ||
30 | #include "../redir.h" | ||
31 | #include "../trap.h" | ||
32 | +#include "../bashintl.h" | ||
33 | |||
34 | #if defined (HISTORY) | ||
35 | @@ -235,10 +236,23 @@ | ||
36 | struct fd_bitmap *bitmap; | ||
37 | |||
38 | - if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) | ||
39 | + if (flags & SEVAL_FUNCDEF) | ||
40 | { | ||
41 | - internal_warning ("%s: ignoring function definition attempt", from_file); | ||
42 | - should_jump_to_top_level = 0; | ||
43 | - last_result = last_command_exit_value = EX_BADUSAGE; | ||
44 | - break; | ||
45 | + char *x; | ||
46 | + | ||
47 | + /* If the command parses to something other than a straight | ||
48 | + function definition, or if we have not consumed the entire | ||
49 | + string, or if the parser has transformed the function | ||
50 | + name (as parsing will if it begins or ends with shell | ||
51 | + whitespace, for example), reject the attempt */ | ||
52 | + if (command->type != cm_function_def || | ||
53 | + ((x = parser_remaining_input ()) && *x) || | ||
54 | + (STREQ (from_file, command->value.Function_def->name->word) == 0)) | ||
55 | + { | ||
56 | + internal_warning (_("%s: ignoring function definition attempt"), from_file); | ||
57 | + should_jump_to_top_level = 0; | ||
58 | + last_result = last_command_exit_value = EX_BADUSAGE; | ||
59 | + reset_parser (); | ||
60 | + break; | ||
61 | + } | ||
62 | } | ||
63 | |||
64 | @@ -302,5 +316,8 @@ | ||
65 | |||
66 | if (flags & SEVAL_ONECMD) | ||
67 | - break; | ||
68 | + { | ||
69 | + reset_parser (); | ||
70 | + break; | ||
71 | + } | ||
72 | } | ||
73 | } | ||
74 | --- a/parse.y 2014-09-30 19:43:22.000000000 -0400 | ||
75 | +++ b/parse.y 2014-10-04 15:58:35.000000000 -0400 | ||
76 | @@ -2125,4 +2125,14 @@ | ||
77 | } | ||
78 | |||
79 | +char * | ||
80 | +parser_remaining_input () | ||
81 | +{ | ||
82 | + if (shell_input_line == 0) | ||
83 | + return 0; | ||
84 | + if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) | ||
85 | + return '\0'; /* XXX */ | ||
86 | + return (shell_input_line + shell_input_line_index); | ||
87 | +} | ||
88 | + | ||
89 | #ifdef INCLUDE_UNUSED | ||
90 | /* Back the input pointer up by one, effectively `ungetting' a character. */ | ||
91 | --- a/shell.h 2008-04-28 22:00:24.000000000 -0400 | ||
92 | +++ b/shell.h 2014-10-04 15:58:35.000000000 -0400 | ||
93 | @@ -161,4 +161,6 @@ | ||
94 | |||
95 | /* Let's try declaring these here. */ | ||
96 | +extern char *parser_remaining_input __P((void)); | ||
97 | + | ||
98 | extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *)); | ||
99 | extern void restore_parser_state __P((sh_parser_state_t *)); | ||