Skip to contentSkip to conversation

CVE fixes of package readline and gnupg

PATCH In review Kai Kang 4 participants 19 messages Oct 16, 2014 – Oct 9, 2015

lore
Share & tools
lore

Kai Kang

author
#0 lore raw

cover CVE fixes of package readline and gnupg

The following changes since commit 505a6b696ae990442de720e5e1135a3e44d5f75c:

bitbake: fetcher: fix BB_STRICT_CHECKSUM datatype check (2014-10-06 16:09:53 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib kangkai/CVEs
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=kangkai/CVEs

Kai Kang (3):
readline: Security Advisory - readline - CVE-2014-2524
gnupg: CVE-2013-4242
gnupg_1.4.7: add package config libusb

 .../readline/readline-6.3/readline63-003           | 43 +++++++++++++++
 meta/recipes-core/readline/readline_6.3.bb         |  2 +
 .../gnupg/gnupg-1.4.7/CVE-2013-4242.patch          | 62 ++++++++++++++++++++++
 meta/recipes-support/gnupg/gnupg_1.4.7.bb          |  2 +
 4 files changed, 109 insertions(+)
 create mode 100644 meta/recipes-core/readline/readline-6.3/readline63-003
 create mode 100644 meta/recipes-support/gnupg/gnupg-1.4.7/CVE-2013-4242.patch
Signature · 1 line
1.9.1
author
#1 lore raw

PATCH 1/3 readline: Security Advisory - readline - CVE-2014-2524

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2524

Signed-off-by Yue Tao <[email protected]>
Signed-off-by Kai Kang <[email protected]>
---
 .../readline/readline-6.3/readline63-003           | 43 ++++++++++++++++++++++
 meta/recipes-core/readline/readline_6.3.bb         |  2 +
 2 files changed, 45 insertions(+)
 create mode 100644 meta/recipes-core/readline/readline-6.3/readline63-003
meta/recipes-core/readline/readline-6.3/readline63-003 new file +43 -0
new file mode 100644
index 0000000..98a9d81
@@ -0,0 +1,43 @@
+readline: Security Advisory - readline - CVE-2014-2524
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue Tao <[email protected]>
+
+			   READLINE PATCH REPORT
+			   =====================
+
+Readline-Release: 6.3
+Patch-ID: readline63-003
+
+Bug-Reported-by:
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+There are debugging functions in the readline release that are theoretically
+exploitable as security problems.  They are not public functions, but have
+global linkage.
+
+Patch (apply with `patch -p0'):
+
+*** ../readline-6.3/util.c	2013-09-02 13:36:12.000000000 -0400
+--- util.c	2014-03-20 10:25:53.000000000 -0400
+***************
+*** 477,480 ****
+--- 479,483 ----
+  }
+  
++ #if defined (DEBUG)
+  #if defined (USE_VARARGS)
+  static FILE *_rl_tracefp;
+***************
+*** 539,542 ****
+--- 542,546 ----
+  }
+  #endif
++ #endif /* DEBUG */
+  
+  
+
meta/recipes-core/readline/readline_6.3.bb +2 -0
index aa30f66..2ae73ea 100644
@@ -1,5 +1,7 @@
 require readline.inc
 
+SRC_URI_append = " file://readline63-003"
+
 SRC_URI[archive.md5sum] = "33c8fb279e981274f485fd91da77e94a"
 SRC_URI[archive.sha256sum] = "56ba6071b9462f980c5a72ab0023893b65ba6debb4eeb475d7a563dc65cafd43"
Signature · 1 line
1.9.1
author
#17 lore raw

PATCH 2/3 gnupg: CVE-2013-4242

In reply to Kai Kang

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.

Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in
git://git.gnupg.org/libgcrypt.git

Signed-off-by Yong Zhang <[email protected]>
Signed-off-by Kai Kang <[email protected]>
---
 .../gnupg/gnupg-1.4.7/CVE-2013-4242.patch          | 62 ++++++++++++++++++++++
 meta/recipes-support/gnupg/gnupg_1.4.7.bb          |  1 +
 2 files changed, 63 insertions(+)
 create mode 100644 meta/recipes-support/gnupg/gnupg-1.4.7/CVE-2013-4242.patch
meta/recipes-support/gnupg/gnupg-1.4.7/CVE-2013-4242.patch new file +62 -0
new file mode 100644
index 0000000..c9addca
@@ -0,0 +1,62 @@
+From e2202ff2b704623efc6277fb5256e4e15bac5676 Mon Sep 17 00:00:00 2001
+From: Werner Koch <[email protected]>
+Date: Thu, 25 Jul 2013 11:17:52 +0200
+Subject: [PATCH] Mitigate a flush+reload cache attack on RSA secret
+ exponents.
+
+commit e2202ff2b704623efc6277fb5256e4e15bac5676 from
+git://git.gnupg.org/libgcrypt.git
+
+* mpi/mpi-pow.c (gcry_mpi_powm): Always perfrom the mpi_mul for
+exponents in secure memory.
+
+Upstream-Status: Backport
+
+Signed-off-by: Kai Kang <[email protected]>
+--
+
+The attack is published as http://eprint.iacr.org/2013/448 :
+
+Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel
+Attack by Yuval Yarom and Katrina Falkner. 18 July 2013.
+
+  Flush+Reload is a cache side-channel attack that monitors access to
+  data in shared pages. In this paper we demonstrate how to use the
+  attack to extract private encryption keys from GnuPG.  The high
+  resolution and low noise of the Flush+Reload attack enables a spy
+  program to recover over 98% of the bits of the private key in a
+  single decryption or signing round. Unlike previous attacks, the
+  attack targets the last level L3 cache. Consequently, the spy
+  program and the victim do not need to share the execution core of
+  the CPU. The attack is not limited to a traditional OS and can be
+  used in a virtualised environment, where it can attack programs
+  executing in a different VM.
+
+Index: gnupg-1.4.7/mpi/mpi-pow.c
+===================================================================
+--- gnupg-1.4.7.orig/mpi/mpi-pow.c
++++ gnupg-1.4.7/mpi/mpi-pow.c
+@@ -212,7 +212,13 @@ mpi_powm( MPI res, MPI base, MPI exponen
+ 		tp = rp; rp = xp; xp = tp;
+ 		rsize = xsize;
+ 
+-		if( (mpi_limb_signed_t)e < 0 ) {
++            /* To mitigate the Yarom/Falkner flush+reload cache
++             * side-channel attack on the RSA secret exponent, we do
++             * the multiplication regardless of the value of the
++             * high-bit of E.  But to avoid this performance penalty
++             * we do it only if the exponent has been stored in secure
++             * memory and we can thus assume it is a secret exponent.  */
++		if (esec || (mpi_limb_signed_t)e < 0) {
+ 		    /*mpihelp_mul( xp, rp, rsize, bp, bsize );*/
+ 		    if( bsize < KARATSUBA_THRESHOLD ) {
+ 			mpihelp_mul( xp, rp, rsize, bp, bsize );
+@@ -227,6 +233,8 @@ mpi_powm( MPI res, MPI base, MPI exponen
+ 			mpihelp_divrem(xp + msize, 0, xp, xsize, mp, msize);
+ 			xsize = msize;
+ 		    }
++		}
++		if ( (mpi_limb_signed_t)e < 0 ) {
+ 
+ 		    tp = rp; rp = xp; xp = tp;
+ 		    rsize = xsize;
meta/recipes-support/gnupg/gnupg_1.4.7.bb +1 -0
index ddcc2c2..7be56fd 100644
@@ -17,6 +17,7 @@ SRC_URI = "ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-${PV}.tar.bz2 \
            file://curl_typeof_fix_backport.patch \
            file://CVE-2013-4351.patch \
            file://CVE-2013-4576.patch \
+           file://CVE-2013-4242.patch \
 	  "
 
 SRC_URI[md5sum] = "b06a141cca5cd1a55bbdd25ab833303c"
Signature · 1 line
1.9.1
author
#18 lore raw

PATCH 3/3 gnupg_1.4.7: add package config libusb

In reply to Kai Kang

If build gnupg 1.4.7 after libusb-compat, it shows warning:

WARNING: QA Issue: gnupg rdepends on libusb-compat, but it isn't a build dependency? [build-deps]

Add package config libusb to fix it.

Signed-off-by Kai Kang <[email protected]>
---
 meta/recipes-support/gnupg/gnupg_1.4.7.bb | 1 +
 1 file changed, 1 insertion(+)
meta/recipes-support/gnupg/gnupg_1.4.7.bb +1 -0
index 7be56fd..aef515d 100644
@@ -99,3 +99,4 @@ FILES_${PN}-dbg += "${libexecdir}/${BPN}/.debug"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG[curl] = "--with-libcurl=${STAGING_LIBDIR},--without-libcurl,curl"
+PACKAGECONFIG[libusb] = "--with-libusb=${STAGING_LIBDIR},--without-libusb,libusb-compat"
Signature · 1 line
1.9.1
#2 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

In reply to Kai Kang

meta/recipes-core/readline/readline_6.3.bb line 3

Quoted 5 lines · Kai Kang

+++ b/meta/recipes-core/readline/readline_6.3.bb

meta/recipes-core/readline/readline_6.3.bb +1 -0
@@ -1,5 +1,7 @@
 require readline.inc
 
+SRC_URI_append = " file://readline63-003"

Doing SRC_URI += is the usual thing to do. Does this CVE also apply to readline 5.2 that we ship as a non-GPLv3 alternative?

Ross

#3 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 2 lines · Ross

Does this CVE also apply
to readline 5.2 that we ship as a non-GPLv3 alternative?

Answering my own question, whilst the CVE report says it affects 5.3, the vulnerable function isn't in 5.2.

Ross

author
#4 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

In reply to Burton, Ross
Quoted 7 lines · Ross

meta/recipes-core/readline/readline_6.3.bb line 3

Quoted 5 lines · Kai Kang

+++ b/meta/recipes-core/readline/readline_6.3.bb

meta/recipes-core/readline/readline_6.3.bb +1 -0
@@ -1,5 +1,7 @@
  require readline.inc
 
+SRC_URI_append = " file://readline63-003"

Doing SRC_URI += is the usual thing to do.

OK. I'll send V2.

Thanks,
Kai

Quoted 6 lines

Does this CVE also apply
to readline 5.2 that we ship as a non-GPLv3 alternative?

Ross

Signature · 2 lines
Regards,
Neil | Kai Kang
author
#5 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 10 lines · Kang Kai
Quoted 7 lines · Ross

meta/recipes-core/readline/readline_6.3.bb line 3

Quoted 5 lines · Kai Kang

+++ b/meta/recipes-core/readline/readline_6.3.bb

meta/recipes-core/readline/readline_6.3.bb +1 -0
@@ -1,5 +1,7 @@
  require readline.inc
 
+SRC_URI_append = " file://readline63-003"

Doing SRC_URI += is the usual thing to do.

OK. I'll send V2.

Just notice that you have done it. Thanks.

--Kai

Quoted 12 lines

Thanks,
Kai

Quoted 6 lines

Does this CVE also apply
to readline 5.2 that we ship as a non-GPLv3 alternative?

Ross

Signature · 2 lines
Regards,
Neil | Kai Kang
#6 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

In reply to Kai Kang

Hi Kai,

I played around with the new meta-security-isafw layer and the cve-check-tool. In readline the cve CVE-2014-2524 is marked as 'missing' by the framework and I was confused to start with, since I saw that this commit was included. But after looking at the actual patch I realized that it only contains a report and not the patch itself. My question is if that is with purpose and due to some decision that the CVE isn't really causing any harm or if it's by mistake?

BR Petter

Petter Mabäcker

Technux
<[email protected]>
www.technux.se

2014-10-16 11:48 skrev Kai Kang:

Quoted 1 line

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3

Quoted 1 line

allows local users to create or overwrite arbitrary files via a symlink

Quoted 3 lines

attack on a /var/tmp/rltrace.[PID] file.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2524 [1]

Quoted 2 lines
Signed-off-by Yue Tao <[email protected]>
Quoted 1 line
Signed-off-by Kai Kang

<[email protected]>

Quoted 2 lines

---

.../readline/readline-6.3/readline63-003 | 43 ++++++++++++++++++++++

Quoted 1 line

meta/recipes-core/readline/readline_6.3.bb | 2 +

Quoted 1 line
2 files changed, 45

insertions(+)

Quoted 1 line

create mode 100644

meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 2 lines

diff --git

a/meta/recipes-core/readline/readline-6.3/readline63-003 b/meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 1 line

new file mode

100644

Quoted 3 lines

index 0000000..98a9d81
--- /dev/null
+++

b/meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 1 line

@@ -0,0 +1,43

@@

Review

Quoted 3 lines
(quoted diff) +2 -0
+readline: Security Advisory - readline - CVE-2014-2524
+

+Upstream-Status: Backport

Review

Quoted 2 lines
(quoted diff) +2 -0
+
+Signed-off-by: Yue Tao

<[email protected]>

meta/recipes-core/readline/readline-6.3/readline63-003 line 9

Quoted 3 lines
meta/recipes-core/readline/readline-6.3/readline63-003 new file +3 -0
+
+ READLINE PATCH REPORT
+

=====================

meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 3 lines
meta/recipes-core/readline/readline-6.3/readline63-003 new file +3 -0
+
+Readline-Release: 6.3
+Patch-ID:

readline63-003

meta/recipes-core/readline/readline-6.3/readline63-003 line 14

Quoted 4 lines
meta/recipes-core/readline/readline-6.3/readline63-003 new file +3 -0
+
+Bug-Reported-by:
+Bug-Reference-ID:

+Bug-Reference-URL:

meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 4 lines
meta/recipes-core/readline/readline-6.3/readline63-003 new file +4 -0
+
+Bug-Description:
+
+There are debugging

functions in the readline release that are theoretically

Quoted 1 line

+exploitable

as security problems. They are not public functions, but have

Quoted 1 line

+global

linkage.

meta/recipes-core/readline/readline-6.3/readline63-003

Quoted 4 lines
meta/recipes-core/readline/readline-6.3/readline63-003 new file +4 -0
+
+Patch (apply with `patch -p0'):
+
+***

../readline-6.3/util.c 2013-09-02 13:36:12.000000000 -0400

Quoted 1 line

+--- util.c

2014-03-20 10:25:53.000000000 -0400

Review

Quoted 2 lines
(quoted diff) +2 -0
+***************
+*** 477,480

****

Quoted 5 lines

+--- 479,483 ----
+ }
+
++ #if defined (DEBUG)
+ #if

defined (USE_VARARGS)

Quoted 3 lines

+ static FILE *_rl_tracefp;
+***************

+*** 539,542 ****

Quoted 4 lines

+--- 542,546 ----
+ }
+ #endif
++ #endif /*

DEBUG */

Quoted 4 lines

+
+
+
diff --git

a/meta/recipes-core/readline/readline_6.3.bb
b/meta/recipes-core/readline/readline_6.3.bb

Quoted 1 line

index aa30f66..2ae73ea

100644

Quoted 2 lines

--- a/meta/recipes-core/readline/readline_6.3.bb
+++

b/meta/recipes-core/readline/readline_6.3.bb

Quoted 2 lines
(quoted diff) +0 -0
@@ -1,5 +1,7 @@

require

readline.inc

meta/recipes-core/readline/readline_6.3.bb line 4

Quoted 4 lines
meta/recipes-core/readline/readline_6.3.bb +2 -0
+SRC_URI_append = " file://readline63-003"
+

SRC_URI[archive.md5sum] = "33c8fb279e981274f485fd91da77e94a"

Quoted 1 line

SRC_URI[archive.sha256sum] = "56ba6071b9462f980c5a72ab0023893b65ba6debb4eeb475d7a563dc65cafd43"

Quoted 2 lines
Quoted 1 line

1.9.1

Links:
------
[1]
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2524

#7 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 9 lines · Petter Mabäcker

I played around with the new meta-security-isafw layer and the cve-check-tool. In readline the cve CVE-2014-2524 is marked as 'missing' by the framework and I was confused to start with, since I saw that this commit was included. But after looking at the actual patch I realized that it only contains a report and not the patch itself. My question is if that is with purpose and due to some decision that the CVE isn't really causing any harm or if it's by mistake?

As can be seen at
http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html the CVE patch is simply adding a #if defined (DEBUG), which is in the patch included in oe-core master as readline-6.3/readline63-003.

The tool is probably reporting it as missing as -- if i recall correctly -- it identifies CVE patches by filename.

Ross

#8 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Petter Mabäcker

Technux
<[email protected]>
www.technux.se

2015-10-06 12:06 skrev Burton, Ross:

Quoted 1 line

On 6 October 2015 at 09:11, Petter Mabäcker <[email protected]>

Quoted 2 lines · wrote:
Quoted 2 lines

I played around with the new meta-security-isafw layer and

the cve-check-tool. In readline the cve CVE-2014-2524 is marked as 'missing' by the framework and I was confused to start with, since I saw that this commit was included. But after looking at the actual patch I realized that it only contains a report and not the patch itself. My question is if that is with purpose and due to some decision that the CVE isn't really causing any harm or if it's by mistake?

Quoted 2 lines

As can be

seen at
http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html [1] the CVE patch is simply adding a #if defined (DEBUG), which is in the patch included in oe-core master as readline-6.3/readline63-003.

Quoted 2 lines

The tool is probably reporting it as missing as -- if i recall correctly -- it identifies CVE patches by filename.

Quoted 2 lines

Ross

Hi Ross,

That is
correct that the isafw layer assumes that it's named *cve*.patch in order to understand that it's patched in a separate step. But what I really meant was that the file readline63-003 just contains information about the CVE and how to patch the source. It will never be applied on the source, it is just copied to the WORKDIR.

$ pwd

~BUILDDIR/tmp/work/core2-64-poky-linux/readline/6.3-r0 $ls

build
configure-fix.patch norpath.patch readline63-003 temp
config-dirent-symbols.patch configure.sstate readline-6.3 readline-dispatch-multikey.patch

$ grep DEBUG readline-6.3/util.c
$ echo
$?
1

The patch must be applied by something/someone.. For example
Debian solves it by doing their own .diff patch
(http://http.debian.net/debian/pool/main/r/readline6/readline6_6.3-8.debian.tar.xz).
I can send a suggestion about how to solve this in a proper way.

BR
Petter

Links:
------
[1]
http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html

#9 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 5 lines · Petter Mabäcker

The patch must be applied by something/someone.. For example Debian
solves it by doing their own .diff patch (
http://http.debian.net/debian/pool/main/r/readline6/readline6_6.3-8.debian.tar.xz).
I can send a suggestion about how to solve this in a proper way.

Whoops, the file wasn't renamed to .patch and even after being renamed, it isn't actually a properly formatted patch. I'll fix this up now.

Thanks for noticing!

Ross

#10 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

2015-10-06 14:58 skrev Burton, Ross:

Quoted 1 line

On 6 October 2015 at 12:23,

Quoted 2 lines · Petter Mabäcker
Quoted 2 lines

The patch must be

applied by something/someone.. For example Debian solves it by doing their own .diff patch
(http://http.debian.net/debian/pool/main/r/readline6/readline6_6.3-8.debian.tar.xz
[1]). I can send a suggestion about how to solve this in a proper way.

Quoted 2 lines

Whoops, the file wasn't renamed to .patch and even after being

renamed, it isn't actually a properly formatted patch. I'll fix this up now.

Great. As you will notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

BR Petter

Quoted 1 line

Thanks

for noticing!

Quoted 2 lines

Ross

Links:
------
[1]
http://http.debian.net/debian/pool/main/r/readline6/readline6_6.3-8.debian.tar.xz

#11 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 7 lines · Petter Mabäcker

Great. As you will notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Adding the rest of the patches would have been a sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated.

Ross

#12 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

2015-10-06 16:08 skrev Burton, Ross:

Quoted 1 line

On 6 October 2015 at 14:43,

Quoted 2 lines · Petter Mabäcker
Quoted 2 lines

Great. As you will

notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Quoted 2 lines

Adding the rest of the patches would have been a

sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated.

Quoted 2 lines

Ross

I have created a defect and assigned myself
(https://bugzilla.yoctoproject.org/show_bug.cgi?id=8451) and will send something up when the normal integration is open again.

BR Petter

author
#13 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

Quoted 14 lines · Petter Mabäcker

2015-10-06 16:08 skrev Burton, Ross:

Quoted 11 lines · On 6 October 2015 at 14:43, Petter Mabäcker <[email protected]…

Great. As you will notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Quoted 4 lines
Quoted 2 lines

Adding the rest of the patches would have been a sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated. Ross

I have created a defect and assigned myself (https://bugzilla.yoctoproject.org/show_bug.cgi?id=8451) and will send something up when the normal integration is open again. BR Petter

Sorry for late reply that we had The National Day vacation. I can help for this defect if you please.

Signature · 2 lines
Regards,
Neil | Kai Kang
#15 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

In reply to Burton, Ross
Quoted 11 lines · Ross
Quoted 7 lines · Petter Mabäcker

Great. As you will notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Quoted 5 lines

Adding the rest of the patches would have been a sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated.

Ross

The strategy I introduced in 30a38ea1ee933fb134a5ee9000298703cab93692
was not to add the patches, but to fetch them as upstream source.
That was dropped when readline was updated to 6.3 (maybe there was no
patches for it at the time):
66bc6f4127e88db18e260c71d181aecfd58c7999

- ML

#16 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

2015-10-08 06:31 skrev Marko Lindqvist:

Quoted 1 line

On 6 October 2015 at

Quoted 2 lines · Ross
Quoted 2 lines

On 6 October

Quoted 2 lines · Petter Mabäcker
Quoted 2 lines
Quoted 2 lines

Great. As you will notice also when formatted properly it will not apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Quoted 1 line
Quoted 1 line

Adding the rest of the

patches would have been a sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated. Ross

Quoted 2 lines

The strategy I introduced in

30a38ea1ee933fb134a5ee9000298703cab93692

Quoted 1 line

was not to add the patches,

but to fetch them as upstream source.

Quoted 1 line

That was dropped when readline

was updated to 6.3 (maybe there was no

Quoted 2 lines

patches for it at the time):

66bc6f4127e88db18e260c71d181aecfd58c7999

Quoted 2 lines

- ML

Hello Marko,

When
looking at the dates for the 6.3 integration my guess is that no patches existed for 6.3 yet (compared to the dates for the patches..). I will give it a try to use your 5.2 strategy when applying the 6.3 patches to make it looks the same for both versions. Thanks for pointing this out!

BR Petter

Petter Mabäcker

Technux
<[email protected]>
www.technux.se

#14 lore raw

Re: [PATCH 1/3] readline: Security Advisory - readline - CVE-2014-2524

In reply to Kang Kai

2015-10-08 04:13 skrev Kang Kai:

Quoted 1 line

On 2015年10月06日 23:30, Petter

Quoted 4 lines · Mabäcker
Quoted 4 lines

2015-10-06 16:08 skrev Burton, Ross:

Quoted 1 line

On

Quoted 3 lines · Petter Mabäcker
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines

Great. As you will notice also when formatted properly it will not

apply due to that readline63-001 and readline63-002 isn't applied so 'patchlevel' is incorrect. That makes me wondering what the patching strategy is? In my opinion we should consider adding the official readline-6.3 patches as well. Should I add a bug report for that or leave it as is (depending on the strategy...)?

Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

Adding the rest

of the patches would have been a sensible thing to do. Right now, we're frozen as we're about to release 2.0, but a bug or patches post-release would be much appreciated.

Quoted 4 lines
Quoted 4 lines
Quoted 2 lines

Ross

I have created a defect

and assigned myself
(https://bugzilla.yoctoproject.org/show_bug.cgi?id=8451 [1]) and will send something up when the normal integration is open again.

Quoted 2 lines
Quoted 2 lines

BR

Petter

Quoted 2 lines

Sorry for late reply that we had The National Day vacation.

I can help for this defect if you please.

It's OK, I can send something
up for this. See the discussion with Marko within the same thread about a recommended way forward
(http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111353.html).
If you have any requirements for the verification of the bug please update the bug report with this info.

BR Petter

Quoted 3 lines
Signature · 1 line
Regards,

Neil | Kai Kang

Petter Mabäcker

Technux
<[email protected]>
www.technux.se

Links:
------
[1]
https://bugzilla.yoctoproject.org/show_bug.cgi?id=8451