From patchwork Mon Jan 22 14:04:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 38135 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A988CC47DAF for ; Mon, 22 Jan 2024 14:04:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web10.74420.1705932248390038529 for ; Mon, 22 Jan 2024 06:04:08 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D38681FB for ; Mon, 22 Jan 2024 06:04:53 -0800 (PST) Received: from oss-tx204.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 711093F73F for ; Mon, 22 Jan 2024 06:04:07 -0800 (PST) From: ross.burton@arm.com To: openembedded-core@lists.openembedded.org Subject: [PATCH 1/5] cve_check: handle CVE_STATUS being set to the empty string Date: Mon, 22 Jan 2024 14:04:02 +0000 Message-Id: <20240122140406.3837333-1-ross.burton@arm.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 22 Jan 2024 14:04:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/194160 From: Ross Burton Handle CVE_STATUS[...] being set to an empty string just as if it was not set at all. This is needed for evaluated CVE_STATUS values to work, i.e. when setting not-applicable-config if a PACKAGECONFIG is disabled. Signed-off-by: Ross Burton --- meta/lib/oe/cve_check.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py index 3fa77bf9a71..b5fc5364dc8 100644 --- a/meta/lib/oe/cve_check.py +++ b/meta/lib/oe/cve_check.py @@ -231,7 +231,7 @@ def decode_cve_status(d, cve): Convert CVE_STATUS into status, detail and description. """ status = d.getVarFlag("CVE_STATUS", cve) - if status is None: + if not status: return ("", "", "") status_split = status.split(':', 1) @@ -240,7 +240,7 @@ def decode_cve_status(d, cve): status_mapping = d.getVarFlag("CVE_CHECK_STATUSMAP", detail) if status_mapping is None: - bb.warn('Invalid detail %s for CVE_STATUS[%s] = "%s", fallback to Unpatched' % (detail, cve, status)) + bb.warn('Invalid detail "%s" for CVE_STATUS[%s] = "%s", fallback to Unpatched' % (detail, cve, status)) status_mapping = "Unpatched" return (status_mapping, detail, description) From patchwork Mon Jan 22 14:04:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 38134 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA766C47DD9 for ; Mon, 22 Jan 2024 14:04:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web11.74557.1705932248731841943 for ; Mon, 22 Jan 2024 06:04:08 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 692D5FEC for ; Mon, 22 Jan 2024 06:04:54 -0800 (PST) Received: from oss-tx204.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 069303F73F for ; Mon, 22 Jan 2024 06:04:07 -0800 (PST) From: ross.burton@arm.com To: openembedded-core@lists.openembedded.org Subject: [PATCH 2/5] cve_check: cleanup logging Date: Mon, 22 Jan 2024 14:04:03 +0000 Message-Id: <20240122140406.3837333-2-ross.burton@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240122140406.3837333-1-ross.burton@arm.com> References: <20240122140406.3837333-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 22 Jan 2024 14:04:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/194161 From: Ross Burton Primarily list the number of patches found, useful when debugging. Also clean up some bad escaping that caused warnings and use re.IGNORECASE instead of manually doing case-insenstive rang matches. Signed-off-by: Ross Burton --- meta/lib/oe/cve_check.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py index b5fc5364dc8..ed5c714cb8b 100644 --- a/meta/lib/oe/cve_check.py +++ b/meta/lib/oe/cve_check.py @@ -79,20 +79,19 @@ def get_patched_cves(d): import re import oe.patch - pn = d.getVar("PN") - cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") + cve_match = re.compile(r"CVE:( CVE-\d{4}-\d+)+") # Matches the last "CVE-YYYY-ID" in the file name, also if written # in lowercase. Possible to have multiple CVE IDs in a single # file name, but only the last one will be detected from the file name. # However, patch files contents addressing multiple CVE IDs are supported # (cve_match regular expression) - - cve_file_name_match = re.compile(".*([Cc][Vv][Ee]\-\d{4}\-\d+)") + cve_file_name_match = re.compile(r".*(CVE-\d{4}-\d+)", re.IGNORECASE) patched_cves = set() - bb.debug(2, "Looking for patches that solves CVEs for %s" % pn) - for url in oe.patch.src_patches(d): + patches = oe.patch.src_patches(d) + bb.debug(2, "Scanning %d patches for CVEs" % len(patches)) + for url in patches: patch_file = bb.fetch.decodeurl(url)[2] # Check patch file name for CVE ID @@ -100,7 +99,7 @@ def get_patched_cves(d): if fname_match: cve = fname_match.group(1).upper() patched_cves.add(cve) - bb.debug(2, "Found CVE %s from patch file name %s" % (cve, patch_file)) + bb.debug(2, "Found %s from patch file name %s" % (cve, patch_file)) # Remote patches won't be present and compressed patches won't be # unpacked, so say we're not scanning them From patchwork Mon Jan 22 14:04:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 38137 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5439C4725D for ; Mon, 22 Jan 2024 14:04:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web11.74559.1705932249455558704 for ; Mon, 22 Jan 2024 06:04:09 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 0B8B21FB for ; Mon, 22 Jan 2024 06:04:55 -0800 (PST) Received: from oss-tx204.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 9257A3F73F for ; Mon, 22 Jan 2024 06:04:08 -0800 (PST) From: ross.burton@arm.com To: openembedded-core@lists.openembedded.org Subject: [PATCH 3/5] zlib: ignore CVE-2023-6992 Date: Mon, 22 Jan 2024 14:04:04 +0000 Message-Id: <20240122140406.3837333-3-ross.burton@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240122140406.3837333-1-ross.burton@arm.com> References: <20240122140406.3837333-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 22 Jan 2024 14:04:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/194162 From: Ross Burton This issue is specific to the Cloudflare fork of zlib. Signed-off-by: Ross Burton --- meta/recipes-core/zlib/zlib_1.3.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/zlib/zlib_1.3.bb b/meta/recipes-core/zlib/zlib_1.3.bb index 1ed18172faa..9db5588d66a 100644 --- a/meta/recipes-core/zlib/zlib_1.3.bb +++ b/meta/recipes-core/zlib/zlib_1.3.bb @@ -47,3 +47,4 @@ do_install_ptest() { BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip" +CVE_STATUS[CVE-2023-6992] = "not-applicable-config: specific to the Cloudflare fork" From patchwork Mon Jan 22 14:04:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 38136 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C264EC47DDE for ; Mon, 22 Jan 2024 14:04:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web10.74422.1705932249839129299 for ; Mon, 22 Jan 2024 06:04:09 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 945BEFEC for ; Mon, 22 Jan 2024 06:04:55 -0800 (PST) Received: from oss-tx204.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 328D33F73F for ; Mon, 22 Jan 2024 06:04:09 -0800 (PST) From: ross.burton@arm.com To: openembedded-core@lists.openembedded.org Subject: [PATCH 4/5] xserver-xorg: add PACKAGECONFIG for xvfb Date: Mon, 22 Jan 2024 14:04:05 +0000 Message-Id: <20240122140406.3837333-4-ross.burton@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240122140406.3837333-1-ross.burton@arm.com> References: <20240122140406.3837333-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 22 Jan 2024 14:04:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/194163 From: Ross Burton Xvfb is pretty niche and has outstanding unsolved security issues, so let people disable it and add a conditional CVE_STATUS to reflect this. Signed-off-by: Ross Burton --- meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc index 085fcaf87a5..5a0fceea865 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc @@ -116,14 +116,13 @@ FILES:xf86-video-modesetting = "${libdir}/xorg/modules/drivers/modesetting_drv.s EXTRA_OEMESON += " \ -Dxnest=false \ - -Dxvfb=true \ -Ddtrace=false \ -Dint10=x86emu \ -Dxkb_output_dir=/var/lib/xkb \ " OPENGL_PKGCONFIGS = "dri glx glamor dri3" -PACKAGECONFIG ??= "dga dri2 udev ${XORG_CRYPTO} \ +PACKAGECONFIG ??= "dga dri2 udev xvfb ${XORG_CRYPTO} \ ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', '${OPENGL_PKGCONFIGS}', '', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd-logind', '', d)} \ " @@ -138,6 +137,7 @@ PACKAGECONFIG[glamor] = "-Dglamor=true,-Dglamor=false,libepoxy virtual/libgbm,li PACKAGECONFIG[unwind] = "-Dlibunwind=true,-Dlibunwind=false,libunwind" PACKAGECONFIG[systemd-logind] = "-Dsystemd_logind=true,-Dsystemd_logind=false,dbus," PACKAGECONFIG[xinerama] = "-Dxinerama=true,-Dxinerama=false" +PACKAGECONFIG[xvfb] = "-Dxvfb=true,-Dxvfb=false" # Xorg requires a SHA1 implementation, pick one XORG_CRYPTO ??= "openssl" @@ -175,3 +175,5 @@ python populate_packages:prepend() { d.appendVar("RPROVIDES:" + pn, " " + get_abi("input")) d.appendVar("RPROVIDES:" + pn, " " + get_abi("video")) } + +CVE_STATUS[CVE-2023-5574] = "${@bb.utils.contains('PACKAGECONFIG', 'xvfb', '', 'not-applicable-config: specific to Xvfb', d)}" From patchwork Mon Jan 22 14:04:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 38138 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB4A7C47DDB for ; Mon, 22 Jan 2024 14:04:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web11.74562.1705932250458209378 for ; Mon, 22 Jan 2024 06:04:10 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2F28B1FB for ; Mon, 22 Jan 2024 06:04:56 -0800 (PST) Received: from oss-tx204.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id BBA933F73F for ; Mon, 22 Jan 2024 06:04:09 -0800 (PST) From: ross.burton@arm.com To: openembedded-core@lists.openembedded.org Subject: [PATCH 5/5] xserver-xorg: disable xvfb by default Date: Mon, 22 Jan 2024 14:04:06 +0000 Message-Id: <20240122140406.3837333-5-ross.burton@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240122140406.3837333-1-ross.burton@arm.com> References: <20240122140406.3837333-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 22 Jan 2024 14:04:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/194164 From: Ross Burton xvfb has limited use, so to mitigate CVE-2023-5574 out of the box we can disable the xvfb PACKAGECONFIG. Signed-off-by: Ross Burton --- meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc index 5a0fceea865..22f7d9a8adc 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc @@ -122,7 +122,7 @@ EXTRA_OEMESON += " \ " OPENGL_PKGCONFIGS = "dri glx glamor dri3" -PACKAGECONFIG ??= "dga dri2 udev xvfb ${XORG_CRYPTO} \ +PACKAGECONFIG ??= "dga dri2 udev ${XORG_CRYPTO} \ ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', '${OPENGL_PKGCONFIGS}', '', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd-logind', '', d)} \ "