package/connman: fix CVE-2023-28488

PATCH Applied Clement Ramirez 2 participants 4 messages Aug 18, 2023 – Aug 20, 2023

lore

Share & tools

lore

Clement Ramirez

author

2023-08-18 20:05 UTC #0 lore raw

cover package/connman: fix CVE-2023-28488

Hi,

This patch series is designed to fix the CVE-2023-28488:

- The first commit backports the CVE-2023-28488 patch fix onto the 1.41 connman version.

- The second commit bumps connman to 1.42 and removes the previous deprecated patches that introduced fixes now present in the 1.42.

This way the first commit can be used to fix the CVE in LTS releases, and the second one for future releases of Buildroot.

Clement Ramirez (2):
package/connman: fix CVE-2023-28488
package/connman: security bump version to 1.42

 .checkpackageignore                           |   3 -
 ...-gweb-Fix-OOB-write-in-received_data.patch |  36 ----
 ...-reference-counter-to-portal-context.patch | 142 --------------
 ...spr-Update-portal-context-references.patch | 175 ------------------
 package/connman/connman.hash                  |   2 +-
 package/connman/connman.mk                    |   9 +-
 6 files changed, 2 insertions(+), 365 deletions(-)
 delete mode 100644 package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch
 delete mode 100644 package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch
 delete mode 100644 package/connman/0003-wispr-Update-portal-context-references.patch

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Clement Ramirez

author

2023-08-18 20:06 UTC #1 lore raw

PATCH 1/2 package/connman: fix CVE-2023-28488

client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.n process. (see [0] and [1] for details)

[0] https://nvd.nist.gov/vuln/detail/CVE-2023-28488
[1] https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138

Signed-off-by Clement Ramirez <[email protected]>

---
 .checkpackageignore                           |  1 +
 ...ify-and-sanitize-packet-length-first.patch | 62 +++++++++++++++++++
 package/connman/connman.mk                    |  3 +
 3 files changed, 66 insertions(+)
 create mode 100644 package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch

.checkpackageignore +1 -0

index dfc1ba9001..54525e5d90 100644
@@ -266,6 +266,7 @@ package/collectd/0001-src-netlink.c-remove-REG_NOERROR.patch Upstream
 package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch Upstream
 package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch Upstream
 package/connman/0003-wispr-Update-portal-context-references.patch Upstream
+package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch Upstream
 package/connman/S45connman Variables
 package/copas/0001-Do-not-load-coxpcall-for-LuaJIT.patch Upstream
 package/coremark-pro/coremark-pro.sh.in Shellcheck

package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch new file +62 -0

62 lines not on this page · raw message

package/connman/connman.mk +3 -0

index fbd7318e4e..40ce99fa40 100644
@@ -20,6 +20,9 @@ CONNMAN_IGNORE_CVES += CVE-2022-32292
 # 0003-wispr-Update-portal-context-references.patch
 CONNMAN_IGNORE_CVES += CVE-2022-32293
 
+# 0004-gdhcp-Verify-and-sanitize-packet-length-first.patch
+CONNMAN_IGNORE_CVES += CVE-2023-28488
+
 CONNMAN_CONF_OPTS = --with-dbusconfdir=/etc
 
 ifeq ($(BR2_INIT_SYSTEMD),y)

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Clement Ramirez

author

2023-08-18 20:06 UTC #2 lore raw

PATCH 2/2 package/connman: security bump version to 1.42

In reply to Clement Ramirez

The 1.42 version of connman comes with the following CVEs fixes :
- CVE-2022-32292
- CVE-2022-32293
- CVE-2023-28488

These CVEs have been fixed with several patches (links in [0]) introduced by 2 commits (SHAs in [1]), but are now deprecated due to this version bump ('git tag --contains ...' shows that the commits listed in [0] are on the 1.42 tag).

[0] https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd

    https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=72343929836de80727a27d6744c869dff045757c
    https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=416bfaff988882c553c672e5bfc2d4f648d29e8a
    https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138

[1] 2f2b4c80f4 package/connman: fix CVE-2022-3229{2,3}

    f31635b7fe package/connman: fix CVE-2023-28488

Signed-off-by Clement Ramirez <[email protected]>

---
 .checkpackageignore                           |   4 -
 ...-gweb-Fix-OOB-write-in-received_data.patch |  36 ----
 ...-reference-counter-to-portal-context.patch | 142 --------------
 ...spr-Update-portal-context-references.patch | 175 ------------------
 ...ify-and-sanitize-packet-length-first.patch |  62 -------
 package/connman/connman.hash                  |   2 +-
 package/connman/connman.mk                    |  12 +-
 7 files changed, 2 insertions(+), 431 deletions(-)
 delete mode 100644 package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch
 delete mode 100644 package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch
 delete mode 100644 package/connman/0003-wispr-Update-portal-context-references.patch
 delete mode 100644 package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch

.checkpackageignore +0 -4

index 54525e5d90..e5c06b1e0a 100644
@@ -263,10 +263,6 @@ package/chrony/S49chrony Indent Shellcheck Variables
 package/cmake/0001-rename-cmake-rootfile.patch Upstream
 package/cmocka/0001-Don-t-redefine-uintptr_t.patch Upstream
 package/collectd/0001-src-netlink.c-remove-REG_NOERROR.patch Upstream
-package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch Upstream
-package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch Upstream
-package/connman/0003-wispr-Update-portal-context-references.patch Upstream
-package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch Upstream
 package/connman/S45connman Variables
 package/copas/0001-Do-not-load-coxpcall-for-LuaJIT.patch Upstream
 package/coremark-pro/coremark-pro.sh.in Shellcheck

package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch deleted +0 ~~-36~~

deleted file mode 100644
index d1a9d8f8fe..0000000000
@@ -1,36 +0,0 @@
-From d1a5ede5d255bde8ef707f8441b997563b9312bd Mon Sep 17 00:00:00 2001
-From: Nathan Crandall <[email protected]>
-Date: Tue, 12 Jul 2022 08:56:34 +0200
-Subject: gweb: Fix OOB write in received_data()
-
-There is a mismatch of handling binary vs. C-string data with memchr
-and strlen, resulting in pos, count, and bytes_read to become out of
-sync and result in a heap overflow.  Instead, do not treat the buffer
-as an ASCII C-string. We calculate the count based on the return value
-of memchr, instead of strlen.
-
-Fixes: CVE-2022-32292
-
-[Retrieved from:
-https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd]
-Signed-off-by: Fabrice Fontaine <[email protected]>
----
- gweb/gweb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gweb/gweb.c b/gweb/gweb.c
-index 12fcb1d8..13c6c5f2 100644
---- a/gweb/gweb.c
-+++ b/gweb/gweb.c
-@@ -918,7 +918,7 @@ static gboolean received_data(GIOChannel *channel, GIOCondition cond,
- 		}
- 
- 		*pos = '\0';
--		count = strlen((char *) ptr);
-+		count = pos - ptr;
- 		if (count > 0 && ptr[count - 1] == '\r') {
- 			ptr[--count] = '\0';
- 			bytes_read--;
--- 
-cgit 
-

package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch deleted +0 ~~-142~~

142 lines not on this page · raw message

package/connman/0003-wispr-Update-portal-context-references.patch deleted +0 ~~-175~~

175 lines not on this page · raw message

package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch deleted +0 ~~-62~~

62 lines not on this page · raw message

package/connman/connman.hash +1 -1

index 6fc5edf29a..ea87f1ea17 100644
@@ -1,4 +1,4 @@
 # From https://www.kernel.org/pub/linux/network/connman/sha256sums.asc
-sha256  79fb40f4fdd5530c45aa8e592fb16ba23d3674f3a98cf10b89a6576f198de589  connman-1.41.tar.xz
+sha256  a3e6bae46fc081ef2e9dae3caa4f7649de892c3de622c20283ac0ca81423c2aa  connman-1.42.tar.xz
 # Locally computed
 sha256  b499eddebda05a8859e32b820a64577d91f1de2b52efa2a1575a2cb4000bc259  COPYING

package/connman/connman.mk +1 ~~-11~~

index 40ce99fa40..142a6583ad 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CONNMAN_VERSION = 1.41
+CONNMAN_VERSION = 1.42
 CONNMAN_SOURCE = connman-$(CONNMAN_VERSION).tar.xz
 CONNMAN_SITE = $(BR2_KERNEL_MIRROR)/linux/network/connman
 CONNMAN_DEPENDENCIES = libglib2 dbus

@@ -13,16 +13,6 @@ CONNMAN_LICENSE = GPL-2.0
 CONNMAN_LICENSE_FILES = COPYING
 CONNMAN_CPE_ID_VENDOR = intel
 
-# 0001-gweb-Fix-OOB-write-in-received_data.patch
-CONNMAN_IGNORE_CVES += CVE-2022-32292
-
-# 0002-wispr-Add-reference-counter-to-portal-context.patch
-# 0003-wispr-Update-portal-context-references.patch
-CONNMAN_IGNORE_CVES += CVE-2022-32293
-
-# 0004-gdhcp-Verify-and-sanitize-packet-length-first.patch
-CONNMAN_IGNORE_CVES += CVE-2023-28488
-
 CONNMAN_CONF_OPTS = --with-dbusconfdir=/etc
 
 ifeq ($(BR2_INIT_SYSTEMD),y)

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Yann E. MORIN

Applied

2023-08-20 09:14 UTC #3 lore raw

In reply to Clement Ramirez

Clément, Al,

On 2023-08-18 22:05 +0200, Clement Ramirez spake thusly:

Quoted 7 lines

This patch series is designed to fix the CVE-2023-28488:
- The first commit backports the CVE-2023-28488 patch fix onto the 1.41 connman version.
- The second commit bumps connman to 1.42 and removes the previous deprecated patches that introduced fixes now present in the 1.42.
This way the first commit can be used to fix the CVE in LTS releases, and the second one for future releases of Buildroot.

Since the oldest maintenance branch we have already uses connman 1.41, we can just backport the version bump to get all the security fixes.

So I squashed the two commits ogether,

Applied to master, thanks.

Regards,
Yann E. MORIN.

Quoted 22 lines

Clement Ramirez (2):
package/connman: fix CVE-2023-28488
package/connman: security bump version to 1.42

 .checkpackageignore                           |   3 -
 ...-gweb-Fix-OOB-write-in-received_data.patch |  36 ----
 ...-reference-counter-to-portal-context.patch | 142 --------------
 ...spr-Update-portal-context-references.patch | 175 ------------------
 package/connman/connman.hash                  |   2 +-
 package/connman/connman.mk                    |   9 +-
 6 files changed, 2 insertions(+), 365 deletions(-)
 delete mode 100644 package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch
 delete mode 100644 package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch
 delete mode 100644 package/connman/0003-wispr-Update-portal-context-references.patch

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Signature · 10 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot