Skip to contentSkip to conversation

package/tmux: add upstream security fix for CVE-2020-27347

PATCH New Peter Korsgaard 1 participant 3 messages Nov 12, 2020 – Nov 14, 2020

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 package/tmux: add upstream security fix for CVE-2020-27347

Fixes CVE-2020-27347: The function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

For details, see:
https://www.openwall.com/lists/oss-security/2020/11/05/3

Signed-off-by Peter Korsgaard <[email protected]>
---
 ...er-the-end-of-the-array-and-overwrit.patch | 35 +++++++++++++++++++
 package/tmux/tmux.mk                          |  3 ++
 2 files changed, 38 insertions(+)
 create mode 100644 package/tmux/0001-Do-not-write-after-the-end-of-the-array-and-overwrit.patch
package/tmux/0001-Do-not-write-after-the-end-of-the-array-and-overwrit.patch new file +35 -0
new file mode 100644
index 0000000000..d169322ed7
@@ -0,0 +1,35 @@
+From a868bacb46e3c900530bed47a1c6f85b0fbe701c Mon Sep 17 00:00:00 2001
+From: nicm <nicm>
+Date: Thu, 29 Oct 2020 16:33:01 +0000
+Subject: [PATCH] Do not write after the end of the array and overwrite the
+ stack when colon-separated SGR sequences contain empty arguments. Reported by
+ Sergey Nizovtsev.
+
+[Peter: Fixes CVE-2020-27347]
+Signed-off-by: Peter Korsgaard <[email protected]>
+---
+ input.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/input.c b/input.c
+index 42a60c92..c280c0d9 100644
+--- a/input.c
++++ b/input.c
+@@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
+ 				free(copy);
+ 				return;
+ 			}
+-		} else
++		} else {
+ 			n++;
++			if (n == nitems(p)) {
++				free(copy);
++				return;
++			}
++		}
+ 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
+ 	}
+ 	free(copy);
+-- 
+2.20.1
+
package/tmux/tmux.mk +3 -0
index 169c9bb83f..00e77ad762 100644
@@ -10,6 +10,9 @@ TMUX_LICENSE = ISC
 TMUX_LICENSE_FILES = COPYING
 TMUX_DEPENDENCIES = libevent ncurses host-pkgconf
 
+# 0001-Do-not-write-after-the-end-of-the-array-and-overwrit.patch
+TMUX_IGNORE_CVES += CVE-2020-27347
+
 # Add /usr/bin/tmux to /etc/shells otherwise some login tools like dropbear
 # can reject the user connection. See man shells.
 define TMUX_ADD_TMUX_TO_SHELLS
Signature · 1 line
2.20.1
author
#1 lore raw

PATCH 1/1 package/tmux: add upstream security fix for CVE-2020-27347

Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2020-27347: The function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

For details, see:
https://www.openwall.com/lists/oss-security/2020/11/05/3

Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 package/tmux: add upstream security fix for CVE-2020-27347

In reply to Peter Korsgaard
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2020-27347: The function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

For details, see:
https://www.openwall.com/lists/oss-security/2020/11/05/3

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2020.02.x and 2020.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard