Fixes for recent bash CVE backports
cover Fixes for recent bash CVE backports
Fixes for the patches being missed from the 4.2 recipes when the CVE patches were backported.
The following changes since commit 1c8f43767c7d78872d38652ea808f30ea825bbef:
bash: Fix CVE-2014-7169 (2014-10-02 00:03:41 -0700)
are available in the git repository at:
git://git.openembedded.org/openembedded-core-contrib paule/dora-bash-cve-backport-fixes
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=paule/dora-bash-cve-backport-fixes
Paul Eggleton (2):
bash: add missing patch for CVE-2014-6271 to 4.2 recipe
bash: add missing patch for CVE-2014-7169 to 4.2 recipe
.../bash/bash-4.2/cve-2014-6271.patch | 95 ++++++++++++++++++++++ .../bash/bash-4.2/cve-2014-7169.patch | 16 ++++ meta/recipes-extended/bash/bash_4.2.bb | 2 + 3 files changed, 113 insertions(+) create mode 100644 meta/recipes-extended/bash/bash-4.2/cve-2014-6271.patch create mode 100644 meta/recipes-extended/bash/bash-4.2/cve-2014-7169.patch
Signature · 1 line
1.9.3
PATCH 1/2 bash: add missing patch for CVE-2014-6271 to 4.2 recipe
The bash_4.2 recipe was missed when the fix was backported to the dora branch.
Patch based on the one from OE-Core master rev 798d833c9d4bd9ab287fa86b85b4d5f128170ed3 by Ross Burton <[email protected]>, with the content replaced from the appropriate upstream patch.
Signed-off-by Paul Eggleton <[email protected]>
--- .../bash/bash-4.2/cve-2014-6271.patch | 95 ++++++++++++++++++++++ meta/recipes-extended/bash/bash_4.2.bb | 1 + 2 files changed, 96 insertions(+) create mode 100644 meta/recipes-extended/bash/bash-4.2/cve-2014-6271.patch
meta/recipes-extended/bash/bash-4.2/cve-2014-6271.patch new file +95 -0
@@ -0,0 +1,95 @@ +Fix CVE-2014-6271, aka ShellShock. This is the upstream 4.2 patchlevel 48, minus the hunk to +set the patch level. + +Upstream-Status: Backport +Signed-off-by: Paul Eggleton <[email protected]> + + BASH PATCH REPORT + ================= + +Bash-Release: 4.2 +Patch-ID: bash42-048 + +Bug-Reported-by: Stephane Chazelas <[email protected]> +Bug-Reference-ID: +Bug-Reference-URL: + +Bug-Description: + +Under certain circumstances, bash will execute user code while processing the +environment for exported function definitions. + +Patch (apply with `patch -p0'): + +*** ../bash-4.2.47/builtins/common.h 2010-05-30 18:31:51.000000000 -0400 +--- builtins/common.h 2014-09-16 19:35:45.000000000 -0400 +*************** +*** 36,39 **** +--- 36,41 ---- + + /* Flags for describe_command, shared between type.def and command.def */ ++ #define SEVAL_FUNCDEF 0x080 /* only allow function definitions */ ++ #define SEVAL_ONECMD 0x100 /* only allow a single command */ + #define CDESC_ALL 0x001 /* type -a */ + #define CDESC_SHORTDESC 0x002 /* command -V */ +*** ../bash-4.2.47/builtins/evalstring.c 2010-11-23 08:22:15.000000000 -0500 +--- builtins/evalstring.c 2014-09-16 19:35:45.000000000 -0400 +*************** +*** 262,265 **** +--- 262,273 ---- + struct fd_bitmap *bitmap; + ++ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) ++ { ++ internal_warning ("%s: ignoring function definition attempt", from_file); ++ should_jump_to_top_level = 0; ++ last_result = last_command_exit_value = EX_BADUSAGE; ++ break; ++ } ++ + bitmap = new_fd_bitmap (FD_BITMAP_SIZE); + begin_unwind_frame ("pe_dispose"); +*************** +*** 322,325 **** +--- 330,336 ---- + dispose_fd_bitmap (bitmap); + discard_unwind_frame ("pe_dispose"); ++ ++ if (flags & SEVAL_ONECMD) ++ break; + } + } +*** ../bash-4.2.47/variables.c 2011-03-01 16:15:20.000000000 -0500 +--- variables.c 2014-09-16 19:35:45.000000000 -0400 +*************** +*** 348,357 **** + strcpy (temp_string + char_index + 1, string); + +! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST); +! +! /* Ancient backwards compatibility. Old versions of bash exported +! functions like name()=() {...} */ +! if (name[char_index - 1] == ')' && name[char_index - 2] == '(') +! name[char_index - 2] = '\0'; + + if (temp_var = find_function (name)) +--- 348,355 ---- + strcpy (temp_string + char_index + 1, string); + +! /* Don't import function names that are invalid identifiers from the +! environment. */ +! if (legal_identifier (name)) +! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); + + if (temp_var = find_function (name)) +*************** +*** 362,369 **** + else + report_error (_("error importing function definition for `%s'"), name); +- +- /* ( */ +- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0') +- name[char_index - 2] = '('; /* ) */ + } + #if defined (ARRAY_VARS) +--- 360,363 ----
meta/recipes-extended/bash/bash_4.2.bb +1 -0
@@ -21,6 +21,7 @@ SRC_URI = "${GNU_MIRROR}/bash/${BPN}-${PV}.tar.gz;name=tarball \ file://mkbuiltins_have_stringize.patch \ file://build-tests.patch \ file://test-output.patch \ + file://cve-2014-6271.patch;striplevel=0 \ file://run-ptest \ "
Signature · 1 line
1.9.3
PATCH 2/2 bash: add missing patch for CVE-2014-7169 to 4.2 recipe
In reply to Paul EggletonThe bash_4.2 recipe was missed when the fix was backported to the dora branch.
Patch from OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc by Khem Raj <[email protected]>
Signed-off-by Paul Eggleton <[email protected]>
--- meta/recipes-extended/bash/bash-4.2/cve-2014-7169.patch | 16 ++++++++++++++++ meta/recipes-extended/bash/bash_4.2.bb | 1 + 2 files changed, 17 insertions(+) create mode 100644 meta/recipes-extended/bash/bash-4.2/cve-2014-7169.patch
meta/recipes-extended/bash/bash-4.2/cve-2014-7169.patch new file +16 -0
@@ -0,0 +1,16 @@ +Taken from http://www.openwall.com/lists/oss-security/2016/09/25/10 + +Upstream-Status: Backport +Index: bash-4.3/parse.y +=================================================================== +--- bash-4.3.orig/parse.y 2014-09-26 13:10:44.340080056 -0700 ++++ bash-4.3/parse.y 2014-09-26 13:11:44.764080056 -0700 +@@ -2953,6 +2953,8 @@ + FREE (word_desc_to_read); + word_desc_to_read = (WORD_DESC *)NULL; + ++ eol_ungetc_lookahead = 0; ++ + current_token = '\n'; /* XXX */ + last_read_token = '\n'; + token_to_read = '\n';
meta/recipes-extended/bash/bash_4.2.bb +1 -0
@@ -22,6 +22,7 @@ SRC_URI = "${GNU_MIRROR}/bash/${BPN}-${PV}.tar.gz;name=tarball \ file://build-tests.patch \ file://test-output.patch \ file://cve-2014-6271.patch;striplevel=0 \ + file://cve-2014-7169.patch \ file://run-ptest \ "
Signature · 1 line
1.9.3