diff options
Diffstat (limited to 'meta/recipes-devtools/go/go-1.14/CVE-2021-38297.patch')
-rw-r--r-- | meta/recipes-devtools/go/go-1.14/CVE-2021-38297.patch | 97 |
1 files changed, 97 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2021-38297.patch b/meta/recipes-devtools/go/go-1.14/CVE-2021-38297.patch new file mode 100644 index 0000000000..24ceabf808 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2021-38297.patch | |||
@@ -0,0 +1,97 @@ | |||
1 | From 4548fcc8dfd933c237f29bba6f90040a85922564 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Knyszek <mknyszek@google.com> | ||
3 | Date: Thu, 2 Sep 2021 16:51:59 -0400 | ||
4 | Subject: [PATCH] [release-branch.go1.16] misc/wasm, cmd/link: do not let | ||
5 | command line args overwrite global data | ||
6 | |||
7 | On Wasm, wasm_exec.js puts command line arguments at the beginning | ||
8 | of the linear memory (following the "zero page"). Currently there | ||
9 | is no limit for this, and a very long command line can overwrite | ||
10 | the program's data section. Prevent this by limiting the command | ||
11 | line to 4096 bytes, and in the linker ensuring the data section | ||
12 | starts at a high enough address (8192). | ||
13 | |||
14 | (Arguably our address assignment on Wasm is a bit confusing. This | ||
15 | is the minimum fix I can come up with.) | ||
16 | |||
17 | Thanks to Ben Lubar for reporting this issue. | ||
18 | |||
19 | Change by Cherry Mui <cherryyz@google.com>. | ||
20 | |||
21 | For #48797 | ||
22 | Fixes #48799 | ||
23 | Fixes CVE-2021-38297 | ||
24 | |||
25 | Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3 | ||
26 | Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933 | ||
27 | Reviewed-by: Roland Shoemaker <bracewell@google.com> | ||
28 | Reviewed-by: Than McIntosh <thanm@google.com> | ||
29 | Reviewed-on: https://go-review.googlesource.com/c/go/+/354591 | ||
30 | Trust: Michael Knyszek <mknyszek@google.com> | ||
31 | Reviewed-by: Heschi Kreinick <heschi@google.com> | ||
32 | |||
33 | CVE: CVE-2021-38297 | ||
34 | |||
35 | Upstream-Status: Backport: | ||
36 | https://github.com/golang/go/commit/4548fcc8dfd933c237f29bba6f90040a85922564 | ||
37 | |||
38 | Inline of ctxt.isWAsm followin this implemetation: | ||
39 | https://github.com/golang/go/blob/4548fcc8dfd933c237f29bba6f90040a85922564/src/cmd/link/internal/ld/target.go#L127 | ||
40 | |||
41 | Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> | ||
42 | --- | ||
43 | misc/wasm/wasm_exec.js | 7 +++++++ | ||
44 | src/cmd/link/internal/ld/data.go | 11 ++++++++++- | ||
45 | 2 files changed, 17 insertions(+), 1 deletion(-) | ||
46 | |||
47 | diff --git a/misc/wasm/wasm_exec.js b/misc/wasm/wasm_exec.js | ||
48 | index 82041e6bb901..a0a264278b1b 100644 | ||
49 | --- a/misc/wasm/wasm_exec.js | ||
50 | +++ b/misc/wasm/wasm_exec.js | ||
51 | @@ -564,6 +564,13 @@ | ||
52 | offset += 8; | ||
53 | }); | ||
54 | |||
55 | + // The linker guarantees global data starts from at least wasmMinDataAddr. | ||
56 | + // Keep in sync with cmd/link/internal/ld/data.go:wasmMinDataAddr. | ||
57 | + const wasmMinDataAddr = 4096 + 4096; | ||
58 | + if (offset >= wasmMinDataAddr) { | ||
59 | + throw new Error("command line too long"); | ||
60 | + } | ||
61 | + | ||
62 | this._inst.exports.run(argc, argv); | ||
63 | if (this.exited) { | ||
64 | this._resolveExitPromise(); | ||
65 | diff --git a/src/cmd/link/internal/ld/data.go b/src/cmd/link/internal/ld/data.go | ||
66 | index 52035e96301c..54a1d188cdb9 100644 | ||
67 | --- a/src/cmd/link/internal/ld/data.go | ||
68 | +++ b/src/cmd/link/internal/ld/data.go | ||
69 | @@ -2330,6 +2330,11 @@ func assignAddress(ctxt *Link, sect *sym.Section, n int, s loader.Sym, va uint64 | ||
70 | return sect, n, va | ||
71 | } | ||
72 | |||
73 | +// On Wasm, we reserve 4096 bytes for zero page, then 4096 bytes for wasm_exec.js | ||
74 | +// to store command line args. Data sections starts from at least address 8192. | ||
75 | +// Keep in sync with wasm_exec.js. | ||
76 | +const wasmMinDataAddr = 4096 + 4096 | ||
77 | + | ||
78 | // address assigns virtual addresses to all segments and sections and | ||
79 | // returns all segments in file order. | ||
80 | func (ctxt *Link) address() []*sym.Segment { | ||
81 | @@ -2339,10 +2344,14 @@ func (ctxt *Link) address() []*sym.Segment { | ||
82 | order = append(order, &Segtext) | ||
83 | Segtext.Rwx = 05 | ||
84 | Segtext.Vaddr = va | ||
85 | - for _, s := range Segtext.Sections { | ||
86 | + for i, s := range Segtext.Sections { | ||
87 | va = uint64(Rnd(int64(va), int64(s.Align))) | ||
88 | s.Vaddr = va | ||
89 | va += s.Length | ||
90 | + | ||
91 | + if ctxt.Arch.Family == sys.Wasm && i == 0 && va < wasmMinDataAddr { | ||
92 | + va = wasmMinDataAddr | ||
93 | + } | ||
94 | } | ||
95 | |||
96 | Segtext.Length = va - uint64(*FlagTextAddr) | ||
97 | \ No newline at end of file | ||