diff mbox series

[dunfell] gawk: Backport CVE-2023-4156 fix

Message ID 20231009162700.94188-1-marex@denx.de
State Accepted, archived
Delegated to: Steve Sakoman
Headers show
Series [dunfell] gawk: Backport CVE-2023-4156 fix | expand

Commit Message

Marek Vasut Oct. 9, 2023, 4:27 p.m. UTC 
Pick fix for CVE-2023-4156 from ubuntu 20.04

A heap out-of-bounds read flaw was found in builtin.c in the gawk
package. This issue may lead to a crash and could be used to read
sensitive information.

https://nvd.nist.gov/vuln/detail/CVE-2023-4156

https://packages.ubuntu.com/source/focal/gawk
gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f

Signed-off-by: Marek Vasut <marex@denx.de>
---
 .../gawk/gawk/CVE-2023-4156.patch             | 26 +++++++++++++++++++
 meta/recipes-extended/gawk/gawk_5.0.1.bb      |  1 +
 2 files changed, 27 insertions(+)
 create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch

Comments

Steve Sakoman Oct. 9, 2023, 5:29 p.m. UTC | #1 
On Mon, Oct 9, 2023 at 6:27 AM Marek Vasut <marex@denx.de> wrote:
>
> Pick fix for CVE-2023-4156 from ubuntu 20.04
>
> A heap out-of-bounds read flaw was found in builtin.c in the gawk
> package. This issue may lead to a crash and could be used to read
> sensitive information.
>
> https://nvd.nist.gov/vuln/detail/CVE-2023-4156
>
> https://packages.ubuntu.com/source/focal/gawk
> gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f
>
> Signed-off-by: Marek Vasut <marex@denx.de>
> ---
>  .../gawk/gawk/CVE-2023-4156.patch             | 26 +++++++++++++++++++
>  meta/recipes-extended/gawk/gawk_5.0.1.bb      |  1 +
>  2 files changed, 27 insertions(+)
>  create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
>
> diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
> new file mode 100644
> index 0000000000..ecfd974af0
> --- /dev/null
> +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
> @@ -0,0 +1,26 @@
> +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
> +From: "Arnold D. Robbins" <arnold@skeeve.com>
> +Date: Wed, 3 Aug 2022 13:00:54 +0300
> +Subject: [PATCH] Smal bug fix in builtin.c.
> +
> +CVE: CVE-2023-4156

Missing Upstream-Status.  Note that ubuntu isn't upstream so please
link to upstream gawk commit.

Thanks!

Steve


> +Signed-off-by: Marek Vasut <marex@denx.de>
> +---
> + ChangeLog | 6 ++++++
> + builtin.c | 5 ++++-
> + 2 files changed, 10 insertions(+), 1 deletion(-)
> +
> +--- gawk-5.1.0.orig/builtin.c
> ++++ gawk-5.1.0/builtin.c
> +@@ -957,7 +957,10 @@ check_pos:
> +                                       s1++;
> +                                       n0--;
> +                               }
> +-                              if (val >= num_args) {
> ++                              // val could be less than zero if someone provides a field width
> ++                              // so large that it causes integer overflow. Mainly fuzzers do this,
> ++                              // but let's try to be good anyway.
> ++                              if (val < 0 || val >= num_args) {
> +                                       toofew = true;
> +                                       break;
> +                               }
> diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb
> index 1b29ec3113..7ca4cb77e4 100644
> --- a/meta/recipes-extended/gawk/gawk_5.0.1.bb
> +++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb
> @@ -17,6 +17,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr"
>
>  SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
>             file://remove-sensitive-tests.patch \
> +           file://CVE-2023-4156.patch \
>             file://run-ptest \
>  "
>
> --
> 2.40.1
>
Marek Vasut Oct. 9, 2023, 7:30 p.m. UTC | #2 
On 10/9/23 19:29, Steve Sakoman wrote:
> On Mon, Oct 9, 2023 at 6:27 AM Marek Vasut <marex@denx.de> wrote:
>>
>> Pick fix for CVE-2023-4156 from ubuntu 20.04
>>
>> A heap out-of-bounds read flaw was found in builtin.c in the gawk
>> package. This issue may lead to a crash and could be used to read
>> sensitive information.
>>
>> https://nvd.nist.gov/vuln/detail/CVE-2023-4156
>>
>> https://packages.ubuntu.com/source/focal/gawk
>> gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f
>>
>> Signed-off-by: Marek Vasut <marex@denx.de>
>> ---
>>   .../gawk/gawk/CVE-2023-4156.patch             | 26 +++++++++++++++++++
>>   meta/recipes-extended/gawk/gawk_5.0.1.bb      |  1 +
>>   2 files changed, 27 insertions(+)
>>   create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
>>
>> diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
>> new file mode 100644
>> index 0000000000..ecfd974af0
>> --- /dev/null
>> +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
>> @@ -0,0 +1,26 @@
>> +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
>> +From: "Arnold D. Robbins" <arnold@skeeve.com>
>> +Date: Wed, 3 Aug 2022 13:00:54 +0300
>> +Subject: [PATCH] Smal bug fix in builtin.c.
>> +
>> +CVE: CVE-2023-4156
> 
> Missing Upstream-Status.  Note that ubuntu isn't upstream so please
> link to upstream gawk commit.

Should be fixed in V2, sorry for the mess.
diff mbox series

Patch

diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
new file mode 100644
index 0000000000..ecfd974af0
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
@@ -0,0 +1,26 @@ 
+From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Wed, 3 Aug 2022 13:00:54 +0300
+Subject: [PATCH] Smal bug fix in builtin.c.
+
+CVE: CVE-2023-4156
+Signed-off-by: Marek Vasut <marex@denx.de>
+---
+ ChangeLog | 6 ++++++
+ builtin.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- gawk-5.1.0.orig/builtin.c
++++ gawk-5.1.0/builtin.c
+@@ -957,7 +957,10 @@ check_pos:
+ 					s1++;
+ 					n0--;
+ 				}
+-				if (val >= num_args) {
++				// val could be less than zero if someone provides a field width
++				// so large that it causes integer overflow. Mainly fuzzers do this,
++				// but let's try to be good anyway.
++				if (val < 0 || val >= num_args) {
+ 					toofew = true;
+ 					break;
+ 				}
diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb
index 1b29ec3113..7ca4cb77e4 100644
--- a/meta/recipes-extended/gawk/gawk_5.0.1.bb
+++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb
@@ -17,6 +17,7 @@  PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr"
 
 SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
            file://remove-sensitive-tests.patch \
+           file://CVE-2023-4156.patch \
            file://run-ptest \
 "