Skip to contentSkip to conversation

patch: add upstream security fix

PATCH New Baruch Siach 3 participants 4 messages Apr 9, 2018 – Apr 10, 2018

lore
Share & tools
lore

Baruch Siach

author
#0 lore raw

PATCH 1/1 patch: add upstream security fix

Fixes CVE-2018-1000156: arbitrary command execution in ed-style patches.

Depend on MMU for now, because the patch adds a fork() call. Upstream later switched to gnulib provided execute(), so this dependency can be dropped on the next version bump.

Signed-off-by Baruch Siach <[email protected]>
---
 ...-files-to-be-missing-for-ed-style-patches.patch |  37 +++++
 ...ry-command-execution-in-ed-style-patches-.patch | 157 +++++++++++++++++++++
 package/patch/Config.in                            |   2 +
 3 files changed, 196 insertions(+)
 create mode 100644 package/patch/0002-Allow-input-files-to-be-missing-for-ed-style-patches.patch
 create mode 100644 package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch
package/patch/0002-Allow-input-files-to-be-missing-for-ed-style-patches.patch new file +37 -0
new file mode 100644
index 000000000000..7d5757d1af8d
@@ -0,0 +1,37 @@
+From b5a91a01e5d0897facdd0f49d64b76b0f02b43e1 Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <[email protected]>
+Date: Fri, 6 Apr 2018 11:34:51 +0200
+Subject: [PATCH] Allow input files to be missing for ed-style patches
+
+* src/pch.c (do_ed_script): Allow input files to be missing so that new
+files will be created as with non-ed-style patches.
+
+Signed-off-by: Baruch Siach <[email protected]>
+---
+Upstream status: commit b5a91a01e5d0
+
+ src/pch.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/pch.c b/src/pch.c
+index bc6278c4032c..0c5cc2623079 100644
+--- a/src/pch.c
++++ b/src/pch.c
+@@ -2394,9 +2394,11 @@ do_ed_script (char const *inname, char const *outname,
+ 
+     if (! dry_run && ! skip_rest_of_patch) {
+ 	int exclusive = *outname_needs_removal ? 0 : O_EXCL;
+-	assert (! inerrno);
+-	*outname_needs_removal = true;
+-	copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
++	if (inerrno != ENOENT)
++	  {
++	    *outname_needs_removal = true;
++	    copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
++	  }
+ 	sprintf (buf, "%s %s%s", editor_program,
+ 		 verbosity == VERBOSE ? "" : "- ",
+ 		 outname);
+-- 
+2.16.3
+
package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch new file +157 -0

157 lines not on this page · raw message

package/patch/Config.in +2 -0
index 0c2425823a26..13fa7bfc52ed 100644
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_PATCH
 	bool "patch"
+	depends on BR2_USE_MMU # fork()
 	depends on BR2_USE_WCHAR
 	depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
 	help

@@ -10,4 +11,5 @@ config BR2_PACKAGE_PATCH
 
 comment "patch needs a toolchain w/ wchar"
 	depends on !BR2_USE_WCHAR
+	depends on BR2_USE_MMU
 	depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
Signature · 1 line
2.16.3
Applied
#1 lore raw

PATCH 1/1 patch: add upstream security fix

Hello,

Quoted 6 lines · Baruch Siach

Fixes CVE-2018-1000156: arbitrary command execution in ed-style patches.

Depend on MMU for now, because the patch adds a fork() call. Upstream later switched to gnulib provided execute(), so this dependency can be dropped on the next version bump.

Quoted 8 lines
Signed-off-by Baruch Siach <[email protected]>
---
 ...-files-to-be-missing-for-ed-style-patches.patch |  37 +++++
 ...ry-command-execution-in-ed-style-patches-.patch | 157 +++++++++++++++++++++
 package/patch/Config.in                            |   2 +
 3 files changed, 196 insertions(+)
 create mode 100644 package/patch/0002-Allow-input-files-to-be-missing-for-ed-style-patches.patch
 create mode 100644 package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com
#2 lore raw

PATCH 1/1 patch: add upstream security fix

In reply to Baruch Siach
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Fixes CVE-2018-1000156: arbitrary command execution in ed-style patches. Depend on MMU for now, because the patch adds a fork() call. Upstream later switched to gnulib provided execute(), so this dependency can be dropped on the next version bump.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2018.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 1/1 patch: add upstream security fix

In reply to Baruch Siach
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Fixes CVE-2018-1000156: arbitrary command execution in ed-style patches. Depend on MMU for now, because the patch adds a fork() call. Upstream later switched to gnulib provided execute(), so this dependency can be dropped on the next version bump.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard