summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch77
-rw-r--r--meta/recipes-core/systemd/systemd/0028-journal-do-not-remove-multiple-spaces-after-identifi.patch84
-rw-r--r--meta/recipes-core/systemd/systemd_239.bb2
3 files changed, 163 insertions, 0 deletions
diff --git a/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch b/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch
new file mode 100644
index 0000000000..d4df0e12fd
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch
@@ -0,0 +1,77 @@
1From 8ccebb04e07628f7fe10131d6cd4f19d6a0d8f45 Mon Sep 17 00:00:00 2001
2From: Yu Watanabe <watanabe.yu+github@gmail.com>
3Date: Wed, 8 Aug 2018 15:06:36 +0900
4Subject: [PATCH] journal: fix syslog_parse_identifier()
5
6Fixes #9829.
7
8An out of bounds read was discovered in systemd-journald in the way it
9parses log messages that terminate with a colon ':'. A local attacker
10can use this flaw to disclose process memory data.
11
12Patch backported from systemd master at
13a6aadf4ae0bae185dc4c414d492a4a781c80ffe5.
14
15This matches the change done for systemd-journald, hence forming the first
16part of the fix for CVE-2018-16866.
17---
18 src/journal/journald-syslog.c | 6 +++---
19 src/journal/test-journal-syslog.c | 10 ++++++++--
20 2 files changed, 11 insertions(+), 5 deletions(-)
21
22diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
23index 9dea116722..97711ac7a3 100644
24--- a/src/journal/journald-syslog.c
25+++ b/src/journal/journald-syslog.c
26@@ -194,7 +194,7 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)
27 e = l;
28 l--;
29
30- if (p[l-1] == ']') {
31+ if (l > 0 && p[l-1] == ']') {
32 size_t k = l-1;
33
34 for (;;) {
35@@ -219,8 +219,8 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)
36 if (t)
37 *identifier = t;
38
39- if (strchr(WHITESPACE, p[e]))
40- e++;
41+ e += strspn(p + e, WHITESPACE);
42+
43 *buf = p + e;
44 return e;
45 }
46diff --git a/src/journal/test-journal-syslog.c b/src/journal/test-journal-syslog.c
47index 9ba86f6c8a..05f759817e 100644
48--- a/src/journal/test-journal-syslog.c
49+++ b/src/journal/test-journal-syslog.c
50@@ -5,8 +5,8 @@
51 #include "macro.h"
52 #include "string-util.h"
53
54-static void test_syslog_parse_identifier(const char* str,
55- const char *ident, const char*pid, int ret) {
56+static void test_syslog_parse_identifier(const char *str,
57+ const char *ident, const char *pid, int ret) {
58 const char *buf = str;
59 _cleanup_free_ char *ident2 = NULL, *pid2 = NULL;
60 int ret2;
61@@ -21,7 +21,13 @@ static void test_syslog_parse_identifier(const char* str,
62 int main(void) {
63 test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", 11);
64 test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 6);
65+ test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 7);
66 test_syslog_parse_identifier("pidu xxx", NULL, NULL, 0);
67+ test_syslog_parse_identifier(":", "", NULL, 1);
68+ test_syslog_parse_identifier(": ", "", NULL, 3);
69+ test_syslog_parse_identifier("pidu:", "pidu", NULL, 5);
70+ test_syslog_parse_identifier("pidu: ", "pidu", NULL, 6);
71+ test_syslog_parse_identifier("pidu : ", NULL, NULL, 0);
72
73 return 0;
74 }
75--
762.11.0
77
diff --git a/meta/recipes-core/systemd/systemd/0028-journal-do-not-remove-multiple-spaces-after-identifi.patch b/meta/recipes-core/systemd/systemd/0028-journal-do-not-remove-multiple-spaces-after-identifi.patch
new file mode 100644
index 0000000000..fa2c01034b
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0028-journal-do-not-remove-multiple-spaces-after-identifi.patch
@@ -0,0 +1,84 @@
1From c3a7da1bbb6d2df8ab7ea1c7ce34ded37a21959f Mon Sep 17 00:00:00 2001
2From: Yu Watanabe <watanabe.yu+github@gmail.com>
3Date: Fri, 10 Aug 2018 11:07:54 +0900
4Subject: [PATCH] journal: do not remove multiple spaces after identifier in
5 syslog message
6
7Single space is used as separator.
8C.f. discussions in #156.
9
10Fixes #9839 introduced by a6aadf4ae0bae185dc4c414d492a4a781c80ffe5.
11
12Patch backported from systemd master at
138595102d3ddde6d25c282f965573a6de34ab4421.
14
15This matches the change done for systemd-journald, hence forming the second
16part of the fix for CVE-2018-16866
17---
18 src/journal/journald-syslog.c | 4 +++-
19 src/journal/test-journal-syslog.c | 24 ++++++++++++++----------
20 2 files changed, 17 insertions(+), 11 deletions(-)
21
22diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
23index 97711ac7a3..e0b55cc566 100644
24--- a/src/journal/journald-syslog.c
25+++ b/src/journal/journald-syslog.c
26@@ -219,7 +219,9 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)
27 if (t)
28 *identifier = t;
29
30- e += strspn(p + e, WHITESPACE);
31+ /* Single space is used as separator */
32+ if (p[e] != '\0' && strchr(WHITESPACE, p[e]))
33+ e++;
34
35 *buf = p + e;
36 return e;
37diff --git a/src/journal/test-journal-syslog.c b/src/journal/test-journal-syslog.c
38index 05f759817e..7294cde032 100644
39--- a/src/journal/test-journal-syslog.c
40+++ b/src/journal/test-journal-syslog.c
41@@ -6,7 +6,7 @@
42 #include "string-util.h"
43
44 static void test_syslog_parse_identifier(const char *str,
45- const char *ident, const char *pid, int ret) {
46+ const char *ident, const char *pid, const char *rest, int ret) {
47 const char *buf = str;
48 _cleanup_free_ char *ident2 = NULL, *pid2 = NULL;
49 int ret2;
50@@ -16,18 +16,22 @@ static void test_syslog_parse_identifier(const char *str,
51 assert_se(ret == ret2);
52 assert_se(ident == ident2 || streq_ptr(ident, ident2));
53 assert_se(pid == pid2 || streq_ptr(pid, pid2));
54+ assert_se(streq(buf, rest));
55 }
56
57 int main(void) {
58- test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", 11);
59- test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 6);
60- test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 7);
61- test_syslog_parse_identifier("pidu xxx", NULL, NULL, 0);
62- test_syslog_parse_identifier(":", "", NULL, 1);
63- test_syslog_parse_identifier(": ", "", NULL, 3);
64- test_syslog_parse_identifier("pidu:", "pidu", NULL, 5);
65- test_syslog_parse_identifier("pidu: ", "pidu", NULL, 6);
66- test_syslog_parse_identifier("pidu : ", NULL, NULL, 0);
67+ test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", "xxx", 11);
68+ test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, "xxx", 6);
69+ test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, " xxx", 6);
70+ test_syslog_parse_identifier("pidu xxx", NULL, NULL, "pidu xxx", 0);
71+ test_syslog_parse_identifier(" pidu xxx", NULL, NULL, " pidu xxx", 0);
72+ test_syslog_parse_identifier("", NULL, NULL, "", 0);
73+ test_syslog_parse_identifier(" ", NULL, NULL, " ", 0);
74+ test_syslog_parse_identifier(":", "", NULL, "", 1);
75+ test_syslog_parse_identifier(": ", "", NULL, " ", 2);
76+ test_syslog_parse_identifier("pidu:", "pidu", NULL, "", 5);
77+ test_syslog_parse_identifier("pidu: ", "pidu", NULL, "", 6);
78+ test_syslog_parse_identifier("pidu : ", NULL, NULL, "pidu : ", 0);
79
80 return 0;
81 }
82--
832.11.0
84
diff --git a/meta/recipes-core/systemd/systemd_239.bb b/meta/recipes-core/systemd/systemd_239.bb
index 54f14d2805..6fbef47166 100644
--- a/meta/recipes-core/systemd/systemd_239.bb
+++ b/meta/recipes-core/systemd/systemd_239.bb
@@ -41,6 +41,8 @@ SRC_URI += "file://touchscreen.rules \
41 file://0024-journald-do-not-store-the-iovec-entry-for-process-co.patch \ 41 file://0024-journald-do-not-store-the-iovec-entry-for-process-co.patch \
42 file://0025-journald-set-a-limit-on-the-number-of-fields-1k.patch \ 42 file://0025-journald-set-a-limit-on-the-number-of-fields-1k.patch \
43 file://0026-journal-remote-set-a-limit-on-the-number-of-fields-i.patch \ 43 file://0026-journal-remote-set-a-limit-on-the-number-of-fields-i.patch \
44 file://0027-journal-fix-syslog_parse_identifier.patch \
45 file://0028-journal-do-not-remove-multiple-spaces-after-identifi.patch \
44 " 46 "
45 47
46# patches made for musl are only applied on TCLIBC is musl 48# patches made for musl are only applied on TCLIBC is musl
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-12 14:36:03 +0000