Skip to contentSkip to conversation

Bash bug fixes and CVE updates

PATCH In review Mark Hatle 1 participant 3 messages Oct 3, 2014

lore
Share & tools
lore

Mark Hatle

author
#0 lore raw

PATCH 1/1 Bash bug fixes and CVE updates

Use the official community fixes by patching to the latest patch level.

The key patches for the active CVEs are listed below:

bash32-052      CVE-2014-6271                           9/24/2014
bash32-053      CVE-2014-7169                           9/26/2014
bash32-054      exported function namespace change      9/27/2014
bash32-055      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash32-056      CVE-2014-6277                           10/2/2014
bash43-025      CVE-2014-6271                           9/24/2014
bash43-026      CVE-2014-7169                           9/26/2014
bash43-027      exported function namespace change      9/27/2014
bash43-028      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash43-029      CVE-2014-6277                           10/2/2014

I am still in the process of validating the before and after behavior of bash using the ptests, I'll let the list know once the tests have been completed.

Mark Hatle (1):
bash: Upgrade bash to latest patch level to fix CVEs

 .../bash/bash-3.2.48/cve-2014-6271.patch           |  77 --------------
 .../bash/bash-3.2.48/cve-2014-7169.patch           |  16 ---
 .../recipes-extended/bash/bash/cve-2014-6271.patch | 114 ---------------------
 .../recipes-extended/bash/bash/cve-2014-7169.patch |  16 ---
 meta/recipes-extended/bash/bash_3.2.48.bb          |  38 ++++---
 meta/recipes-extended/bash/bash_4.3.bb             |  90 +++++++++++++++-
 6 files changed, 112 insertions(+), 239 deletions(-)
 delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-6271.patch
 delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-7169.patch
 delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-6271.patch
 delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-7169.patch
Signature · 1 line
1.9.3
author
#1 lore raw

PATCH 1/1 bash: Upgrade bash to latest patch level to fix CVEs

We upgrade bash_4.3 to patch revision 29, and bash_3.2.48 to 56.

There are numerous community bug fixes included with this set, but the key items are:

bash32-052      CVE-2014-6271                           9/24/2014
bash32-053      CVE-2014-7169                           9/26/2014
bash32-054      exported function namespace change      9/27/2014
bash32-055      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash32-056      CVE-2014-6277                           10/2/2014
bash43-025      CVE-2014-6271                           9/24/2014
bash43-026      CVE-2014-7169                           9/26/2014
bash43-027      exported function namespace change      9/27/2014
bash43-028      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash43-029      CVE-2014-6277                           10/2/2014
Signed-off-by Mark Hatle <[email protected]>
---
 .../bash/bash-3.2.48/cve-2014-6271.patch           |  77 --------------
 .../bash/bash-3.2.48/cve-2014-7169.patch           |  16 ---
 .../recipes-extended/bash/bash/cve-2014-6271.patch | 114 ---------------------
 .../recipes-extended/bash/bash/cve-2014-7169.patch |  16 ---
 meta/recipes-extended/bash/bash_3.2.48.bb          |  38 ++++---
 meta/recipes-extended/bash/bash_4.3.bb             |  90 +++++++++++++++-
 6 files changed, 112 insertions(+), 239 deletions(-)
 delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-6271.patch
 delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-7169.patch
 delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-6271.patch
 delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-7169.patch
meta/recipes-extended/bash/bash-3.2.48/cve-2014-6271.patch deleted +0 -77
deleted file mode 100644
index 7226ffb..0000000
@@ -1,77 +0,0 @@
-Fix CVE-2014-6271, aka ShellShock.
-
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <[email protected]>
-
-*** ../bash-3.2.51/builtins/common.h	2006-03-06 09:38:44.000000000 -0500
---- builtins/common.h	2014-09-16 19:08:02.000000000 -0400
-***************
-*** 34,37 ****
---- 34,39 ----
-  
-  /* Flags for describe_command, shared between type.def and command.def */
-+ #define SEVAL_FUNCDEF	0x080		/* only allow function definitions */
-+ #define SEVAL_ONECMD	0x100		/* only allow a single command */
-  #define CDESC_ALL		0x001	/* type -a */
-  #define CDESC_SHORTDESC		0x002	/* command -V */
-*** ../bash-3.2.51/builtins/evalstring.c	2008-11-15 17:47:04.000000000 -0500
---- builtins/evalstring.c	2014-09-16 19:08:02.000000000 -0400
-***************
-*** 235,238 ****
---- 235,246 ----
-  	      struct fd_bitmap *bitmap;
-  
-+ 	      if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
-+ 		{
-+ 		  internal_warning ("%s: ignoring function definition attempt", from_file);
-+ 		  should_jump_to_top_level = 0;
-+ 		  last_result = last_command_exit_value = EX_BADUSAGE;
-+ 		  break;
-+ 		}
-+ 
-  	      bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
-  	      begin_unwind_frame ("pe_dispose");
-***************
-*** 292,295 ****
---- 300,306 ----
-  	      dispose_fd_bitmap (bitmap);
-  	      discard_unwind_frame ("pe_dispose");
-+ 
-+ 	      if (flags & SEVAL_ONECMD)
-+ 		break;
-  	    }
-  	}
-*** ../bash-3.2.51/variables.c	2008-11-15 17:15:06.000000000 -0500
---- variables.c	2014-09-16 19:10:39.000000000 -0400
-***************
-*** 319,328 ****
-  	  strcpy (temp_string + char_index + 1, string);
-  
-! 	  parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
-! 
-! 	  /* Ancient backwards compatibility.  Old versions of bash exported
-! 	     functions like name()=() {...} */
-! 	  if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
-! 	    name[char_index - 2] = '\0';
-  
-  	  if (temp_var = find_function (name))
---- 319,326 ----
-  	  strcpy (temp_string + char_index + 1, string);
-  
-! 	  /* Don't import function names that are invalid identifiers from the
-! 	     environment. */
-! 	  if (legal_identifier (name))
-! 	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
-  
-  	  if (temp_var = find_function (name))
-***************
-*** 333,340 ****
-  	  else
-  	    report_error (_("error importing function definition for `%s'"), name);
-- 
-- 	  /* ( */
-- 	  if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
-- 	    name[char_index - 2] = '(';		/* ) */
-  	}
-  #if defined (ARRAY_VARS)
---- 331,334 ----
meta/recipes-extended/bash/bash-3.2.48/cve-2014-7169.patch deleted +0 -16
deleted file mode 100644
index 2e734de..0000000
@@ -1,16 +0,0 @@
-Taken from http://www.openwall.com/lists/oss-security/2016/09/25/10
-
-Upstream-Status: Backport
-Index: bash-3.2.48/parse.y
-===================================================================
---- bash-3.2.48.orig/parse.y	2008-04-29 18:24:55.000000000 -0700
-+++ bash-3.2.48/parse.y	2014-09-26 13:07:31.956080056 -0700
-@@ -2503,6 +2503,8 @@
-   FREE (word_desc_to_read);
-   word_desc_to_read = (WORD_DESC *)NULL;
- 
-+  eol_ungetc_lookahead = 0;
-+
-   last_read_token = '\n';
-   token_to_read = '\n';
- }
meta/recipes-extended/bash/bash/cve-2014-6271.patch deleted +0 -114

114 lines not on this page · raw message

meta/recipes-extended/bash/bash/cve-2014-7169.patch deleted +0 -16
deleted file mode 100644
index 3c69121..0000000
@@ -1,16 +0,0 @@
-Taken from http://www.openwall.com/lists/oss-security/2016/09/25/10
-
-Upstream-Status: Backport
-Index: bash-4.3/parse.y
-===================================================================
---- bash-4.3.orig/parse.y	2014-09-26 13:10:44.340080056 -0700
-+++ bash-4.3/parse.y	2014-09-26 13:11:44.764080056 -0700
-@@ -2953,6 +2953,8 @@
-   FREE (word_desc_to_read);
-   word_desc_to_read = (WORD_DESC *)NULL;
- 
-+  eol_ungetc_lookahead = 0;
-+
-   current_token = '\n';		/* XXX */
-   last_read_token = '\n';
-   token_to_read = '\n';
meta/recipes-extended/bash/bash_3.2.48.bb +24 -14
index e6a04cd..77f2514 100644
@@ -6,25 +6,35 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=fd5d9bcabd8ed5a54a01ce8d183d592a"
 PR = "r11"
 
 SRC_URI = "${GNU_MIRROR}/bash/bash-${PV}.tar.gz;name=tarball \
-           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-049;apply=yes;striplevel=0;name=patch001 \
-           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-050;apply=yes;striplevel=0;name=patch002 \
-           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-051;apply=yes;striplevel=0;name=patch003 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-049;apply=yes;striplevel=0;name=patch049 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-050;apply=yes;striplevel=0;name=patch050 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-051;apply=yes;striplevel=0;name=patch051 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-052;apply=yes;striplevel=0;name=patch052 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-053;apply=yes;striplevel=0;name=patch053 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-054;apply=yes;striplevel=0;name=patch054 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-055;apply=yes;striplevel=0;name=patch055 \
+           ${GNU_MIRROR}/bash/bash-3.2-patches/bash32-056;apply=yes;striplevel=0;name=patch056 \
            file://mkbuiltins_have_stringize.patch \
            file://build-tests.patch \
            file://test-output.patch \
-           file://cve-2014-6271.patch;striplevel=0 \
-           file://cve-2014-7169.patch \
            file://run-ptest \
           "
 
 SRC_URI[tarball.md5sum] = "338dcf975a93640bb3eaa843ca42e3f8"
 SRC_URI[tarball.sha256sum] = "128d281bd5682ba5f6953122915da71976357d7a76490d266c9173b1d0426348"
-SRC_URI[patch001.md5sum] = "af571a2d164d5abdcae4499e94e8892c"
-SRC_URI[patch001.sha256sum] = "b1217ed94bdb95dc878fa5cabbf8a164435eb0d9da23a392198f48566ee34a2f"
-SRC_URI[patch002.md5sum] = "8443d4385d73ec835abe401d90591377"
-SRC_URI[patch002.sha256sum] = "081bb03c580ecee63ba03b40beb3caf509eca29515b2e8dd3c078503609a1642"
-SRC_URI[patch003.md5sum] = "15c6653042e9814aa87120098fc7a849"
-SRC_URI[patch003.sha256sum] = "354886097cd95b4def77028f32ee01e2e088d58a98184fede9d3ce9320e218ef"
-
-SRC_URI[md5sum] = "338dcf975a93640bb3eaa843ca42e3f8"
-SRC_URI[sha256sum] = "128d281bd5682ba5f6953122915da71976357d7a76490d266c9173b1d0426348"
+SRC_URI[patch049.md5sum] = "af571a2d164d5abdcae4499e94e8892c"
+SRC_URI[patch049.sha256sum] = "b1217ed94bdb95dc878fa5cabbf8a164435eb0d9da23a392198f48566ee34a2f"
+SRC_URI[patch050.md5sum] = "8443d4385d73ec835abe401d90591377"
+SRC_URI[patch050.sha256sum] = "081bb03c580ecee63ba03b40beb3caf509eca29515b2e8dd3c078503609a1642"
+SRC_URI[patch051.md5sum] = "15c6653042e9814aa87120098fc7a849"
+SRC_URI[patch051.sha256sum] = "354886097cd95b4def77028f32ee01e2e088d58a98184fede9d3ce9320e218ef"
+SRC_URI[patch052.md5sum] = "691023a944bbb9003cc92ad462d91fa1"
+SRC_URI[patch052.sha256sum] = "a0eccf9ceda50871db10d21efdd74b99e35efbd55c970c400eeade012816bb61"
+SRC_URI[patch053.md5sum] = "eb97d1c9230a55283d9dac69d3de2e46"
+SRC_URI[patch053.sha256sum] = "fe6f0e96e0b966eaed9fb5e930ca12891f4380f30f9e0a773d200ff2063a864e"
+SRC_URI[patch054.md5sum] = "1107744058c43b247f597584b88ba0a6"
+SRC_URI[patch054.sha256sum] = "c6dab911e85688c542ce75afc175dbb4e5011de5102758e19a4a80dac1e79359"
+SRC_URI[patch055.md5sum] = "05d201176d3499e2dfa4a73d09d42f05"
+SRC_URI[patch055.sha256sum] = "c0e816700837942ed548da74e5917f74b70cbbbb10c9f2caf73e8e06a0713d0a"
+SRC_URI[patch056.md5sum] = "222eaa3a2c26f54a15aa5e08817a534a"
+SRC_URI[patch056.sha256sum] = "063a8d8d74e4407bf07a32b965b8ef6d213a66abdb6af26cc3584a437a56bbb4"
meta/recipes-extended/bash/bash_4.3.bb +88 -2

104 lines not on this page · raw message

Signature · 1 line
1.9.3
author
#2 lore raw
In reply to Mark Hatle
Quoted 17 lines · Mark Hatle

Use the official community fixes by patching to the latest patch level.

The key patches for the active CVEs are listed below:

bash32-052      CVE-2014-6271                           9/24/2014
bash32-053      CVE-2014-7169                           9/26/2014
bash32-054      exported function namespace change      9/27/2014
bash32-055      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash32-056      CVE-2014-6277                           10/2/2014
bash43-025      CVE-2014-6271                           9/24/2014
bash43-026      CVE-2014-7169                           9/26/2014
bash43-027      exported function namespace change      9/27/2014
bash43-028      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash43-029      CVE-2014-6277                           10/2/2014
Quoted 3 lines

I am still in the process of validating the before and after behavior of bash using the ptests, I'll let the list know once the tests have been completed.

ptests have been run for all of the QEMU machines.

Differences from before and after the patches:

-version: 4.3.0(1)-release
-versinfo: 4 3 0 1 release arm-oe-linux-gnueabi
+version: 4.3.29(2)-release
+versinfo: 4 3 29 2 release arm-oe-linux-gnueabi

(on arm only)

-FAIL: run-heredoc
+PASS: run-heredoc

(on mips64 and x86-64 only)

-PASS: run-jobs
+FAIL: run-jobs

Looking at the surrounding information, I believe both of the above are errors in the the test suite themselves.

--Mark

Quoted 15 lines

Mark Hatle (1):
bash: Upgrade bash to latest patch level to fix CVEs

  .../bash/bash-3.2.48/cve-2014-6271.patch           |  77 --------------
  .../bash/bash-3.2.48/cve-2014-7169.patch           |  16 ---
  .../recipes-extended/bash/bash/cve-2014-6271.patch | 114 ---------------------
  .../recipes-extended/bash/bash/cve-2014-7169.patch |  16 ---
  meta/recipes-extended/bash/bash_3.2.48.bb          |  38 ++++---
  meta/recipes-extended/bash/bash_4.3.bb             |  90 +++++++++++++++-
  6 files changed, 112 insertions(+), 239 deletions(-)

delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-6271.patch delete mode 100644 meta/recipes-extended/bash/bash-3.2.48/cve-2014-7169.patch delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-6271.patch delete mode 100644 meta/recipes-extended/bash/bash/cve-2014-7169.patch