shadow: fix CVE-2017-12424
cover shadow: fix CVE-2017-12424
The following changes since commit 6016ec177af2406cacfeb3276dfcb8bfc3df8fce:
poky.conf: Enable vulkan by default (2017-08-16 00:04:39 +0100)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib ChenQi/CVE-2017-12424
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=ChenQi/CVE-2017-12424
Chen Qi (1):
shadow: fix CVE-2017-12424
.../shadow/files/0001-shadow-CVE-2017-12424 | 46 ++++++++++++++++++++++ meta/recipes-extended/shadow/shadow.inc | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
Signature · 1 line
1.9.1
PATCH 1/1 shadow: fix CVE-2017-12424
Backport a patch to fix CVE-2017-12424.
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors.
Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424
CVE: CVE-2017-12424
--- .../shadow/files/0001-shadow-CVE-2017-12424 | 46 ++++++++++++++++++++++ meta/recipes-extended/shadow/shadow.inc | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424 new file +46 -0
@@ -0,0 +1,46 @@ +From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz <[email protected]> +Date: Fri, 31 Mar 2017 16:25:06 +0200 +Subject: [PATCH] Fix buffer overflow if NULL line is present in db. + +If ptr->line == NULL for an entry, the first cycle will exit, +but the second one will happily write past entries buffer. +We actually do not want to exit the first cycle prematurely +on ptr->line == NULL. +Signed-off-by: Tomas Mraz <[email protected]> + +CVE: CVE-2017-12424 +Upstream-Status: Backport +Signed-off-by: Chen Qi <[email protected]> +--- + lib/commonio.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/commonio.c b/lib/commonio.c +index b10da06..31edbaa 100644 +--- a/lib/commonio.c ++++ b/lib/commonio.c +@@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *)) + for (ptr = db->head; + (NULL != ptr) + #if KEEP_NIS_AT_END +- && (NULL != ptr->line) +- && ( ('+' != ptr->line[0]) +- && ('-' != ptr->line[0])) ++ && ((NULL == ptr->line) ++ || (('+' != ptr->line[0]) ++ && ('-' != ptr->line[0]))) + #endif + ; + ptr = ptr->next) { + n++; + } + #if KEEP_NIS_AT_END +- if ((NULL != ptr) && (NULL != ptr->line)) { ++ if (NULL != ptr) { + nis = ptr; + } + #endif +-- +2.1.0 +
meta/recipes-extended/shadow/shadow.inc +1 -0
@@ -16,6 +16,7 @@ SRC_URI = "http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.xz \ file://0001-Do-not-read-login.defs-before-doing-chroot.patch \ file://check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch \ file://0001-useradd-copy-extended-attributes-of-home.patch \ + file://0001-shadow-CVE-2017-12424 \ ${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \ "
Signature · 1 line
1.9.1
Quoted 9 lines · Chen Qi
Backport a patch to fix CVE-2017-12424.
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors.
Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424
CVE: CVE-2017-12424
I don't object to the patch but I'm wondering if there is a reason we are taking the shadow sources from debian instead of the upstream github*? shadow 4.5 seems to have been out for months already but Debian hasn't taken it yet...
*) https://github.com/shadow-maint/shadow
Jussi
Quoted 89 lines
Signed-off-by Chen Qi <[email protected]>--- .../shadow/files/0001-shadow-CVE-2017-12424 | 46 ++++++++++++++++++++++ meta/recipes-extended/shadow/shadow.inc | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424 new file +23
-0@@ -0,0 +1,46 @@ +From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz <[email protected]> +Date: Fri, 31 Mar 2017 16:25:06 +0200 +Subject: [PATCH] Fix buffer overflow if NULL line is present in db. + +If ptr->line == NULL for an entry, the first cycle will exit, +but the second one will happily write past entries buffer. +We actually do not want to exit the first cycle prematurely +on ptr->line == NULL. +Signed-off-by: Tomas Mraz <[email protected]> + +CVE: CVE-2017-12424 +Upstream-Status: Backport +Signed-off-by: Chen Qi <[email protected]> +--- + lib/commonio.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/commonio.c b/lib/commonio.c +index b10da06..31edbaa 100644 +--- a/lib/commonio.c ++++ b/lib/commonio.c +@@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp)(const void *, const void *))
meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424 new file +23
-0+ for (ptr = db->head; + (NULL != ptr) + #if KEEP_NIS_AT_END +- && (NULL != ptr->line) +- && ( ('+' != ptr->line[0]) +- && ('-' != ptr->line[0])) ++ && ((NULL == ptr->line) ++ || (('+' != ptr->line[0]) ++ && ('-' != ptr->line[0]))) + #endif + ; + ptr = ptr->next) { + n++; + } + #if KEEP_NIS_AT_END +- if ((NULL != ptr) && (NULL != ptr->line)) { ++ if (NULL != ptr) { + nis = ptr; + } + #endif +-- +2.1.0 +meta/recipes-extended/shadow/shadow.inc +1
-0@@ -16,6 +16,7 @@ SRC_URI = "http://pkg-shadow.alioth. debian.org/releases/${BPN}-${PV}.tar.xz \ file://0001-Do-not-read-login.defs-before-doing-chroot.patch \ file://check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch \ file://0001-useradd-copy-extended-attributes-of-home.patch \ + file://0001-shadow-CVE-2017-12424 \ ${@bb.utils.contains('PACKAGECONFIG', 'pam','${PAM_SRC_URI}', '', d)} \ "--
1.9.1--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 13 lines · Jussi Kukkonen
On 16 August 2017 at 13:28, Chen Qi <[email protected] <mailto:[email protected]>> wrote:
Backport a patch to fix CVE-2017-12424. In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424 <https://nvd.nist.gov/vuln/detail/CVE-2017-12424> CVE: CVE-2017-12424
Quoted 5 lines
I don't object to the patch but I'm wondering if there is a reason we are taking the shadow sources from debian instead of the upstream github*? shadow 4.5 seems to have been out for months already but Debian hasn't taken it yet...
*) https://github.com/shadow-maint/shadow
Jussi
Good point. It's late in the release but maybe
not too late to update shadow.
Qi,
If you could give it a try and let us know if there are any 'gotchas' that would prevent or make the upgrade risky, that would be great.
There are quite a few functional changes:
$ git diff 4.2.1..4.5 etc lib libmisc man src | diffstat| tail -1
83 files changed, 4011 insertions(+), 2020 deletions(-)and a HUGE number of other changes:
$ git diff 4.2.1..4.5 | diffstat| tail -1
9818 files changed, 390853 insertions(+), 7556 deletions(-)mainly in tests:
$ git diff 4.2.1..4.5 tests/| diffstat| tail -1
9690 files changed, 369156 insertions(+)
that could, say just post-M3, be added as ptests.../Randy
Quoted 103 lines
Signed-off-by: Chen Qi <[email protected]
<mailto:[email protected]>>
---
.../shadow/files/0001-shadow-CVE-2017-12424 | 46
++++++++++++++++++++++
meta/recipes-extended/shadow/shadow.inc | 1 +
2 files changed, 47 insertions(+)
create mode 100644
meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
diff --git
a/meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
b/meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
new file mode 100644
index 0000000..4d3e1e0
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-shadow-CVE-2017-12424
@@ -0,0 +1,46 @@
+From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <[email protected]
<mailto:[email protected]>>
+Date: Fri, 31 Mar 2017 16:25:06 +0200
+Subject: [PATCH] Fix buffer overflow if NULL line is present in db.
+
+If ptr->line == NULL for an entry, the first cycle will exit,
+but the second one will happily write past entries buffer.
+We actually do not want to exit the first cycle prematurely
+on ptr->line == NULL.
+Signed-off-by: Tomas Mraz <[email protected]
<mailto:[email protected]>>
+
+CVE: CVE-2017-12424
+Upstream-Status: Backport
+Signed-off-by: Chen Qi <[email protected]
<mailto:[email protected]>>
+---
+ lib/commonio.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/lib/commonio.c b/lib/commonio.c
+index b10da06..31edbaa 100644
+--- a/lib/commonio.c
++++ b/lib/commonio.c
+@@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int
(*cmp) (const void *, const void *))
+ for (ptr = db->head;
+ (NULL != ptr)
+ #if KEEP_NIS_AT_END
+- && (NULL != ptr->line)
+- && ( ('+' != ptr->line[0])
+- && ('-' != ptr->line[0]))
++ && ((NULL == ptr->line)
++ || (('+' != ptr->line[0])
++ && ('-' != ptr->line[0])))
+ #endif
+ ;
+ ptr = ptr->next) {
+ n++;
+ }
+ #if KEEP_NIS_AT_END
+- if ((NULL != ptr) && (NULL != ptr->line)) {
++ if (NULL != ptr) {
+ nis = ptr;
+ }
+ #endif
+--
+2.1.0
+
diff --git a/meta/recipes-extended/shadow/shadow.inc
b/meta/recipes-extended/shadow/shadow.inc
index 5e6b0bd..cc18964 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -16,6 +16,7 @@ SRC_URI =
"http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.xz
<http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.xz> \
file://0001-Do-not-read-login.defs-before-doing-chroot.patch \
file://check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch \
file://0001-useradd-copy-extended-attributes-of-home.patch \
+ file://0001-shadow-CVE-2017-12424 \
${@bb.utils.contains('PACKAGECONFIG', 'pam',
'${PAM_SRC_URI}', '', d)} \
"
--
1.9.1
--
_______________________________________________
Openembedded-core mailing list
[email protected]
<mailto:[email protected]>
http://lists.openembedded.org/mailman/listinfo/openembedded-core
<http://lists.openembedded.org/mailman/listinfo/openembedded-core>Signature · 2 lines
# Randy MacLeod. SMTS, Linux, Wind River Direct: 613.963.1350 | 350 Terry Fox Drive, Suite 200, Ottawa, ON, Canada, K2K 2W5
Quoted 21 lines · Randy MacLeod
Quoted 13 lines · Jussi Kukkonen
On 16 August 2017 at 13:28, Chen Qi <[email protected] <mailto:[email protected]>> wrote:
Backport a patch to fix CVE-2017-12424. In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424 <https://nvd.nist.gov/vuln/detail/CVE-2017-12424> CVE: CVE-2017-12424Quoted 5 lines
I don't object to the patch but I'm wondering if there is a reason we are taking the shadow sources from debian instead of the upstream github*? shadow 4.5 seems to have been out for months already but Debian hasn't taken it yet...
*) https://github.com/shadow-maint/shadow
Jussi
Quoted 7 lines
Good point. It's late in the release but maybe
not too late to update shadow.Qi,
If you could give it a try and let us know if there are any 'gotchas' that would prevent or make the upgrade risky, that would be great.
Turns out that Qi will only be able do this at the start of the oe-core-2.5 development cycle.
../Randy
Signature · 2 lines
# Randy MacLeod. SMTS, Linux, Wind River Direct: 613.963.1350 | 350 Terry Fox Drive, Suite 200, Ottawa, ON, Canada, K2K 2W5