| Message ID | 20231009163110.94431-1-marex@denx.de |
|---|---|
| State | New |
| Headers | show |
| Series | ncurses: Mitigate CVE-2023-29491 | expand |
On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: > Configure with "--disable-root-environ" to disallow loading of > custom terminfo entries in setuid/setgid programs, mitigating the > impact of CVE-2023-29491. > > This is taken from debian: > https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b8780d51cd09bd5a08ac > > Signed-off-by: Marek Vasut <marex@denx.de> > --- > Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> > Cc: Richard Purdie <richard.purdie@linuxfoundation.org> > --- > meta/recipes-core/ncurses/ncurses.inc | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-core/ncurses/ncurses.inc b/meta/recipes-core/ncurses/ncurses.inc > index 367f3b19f4..1bc07ec2d4 100644 > --- a/meta/recipes-core/ncurses/ncurses.inc > +++ b/meta/recipes-core/ncurses/ncurses.inc > @@ -87,6 +87,7 @@ ncurses_configure() { > --enable-sigwinch \ > --enable-pc-files \ > --disable-rpath-hack \ > + --disable-root-environ \ > ${EXCONFIG_ARGS} \ > --with-manpage-format=normal \ > --without-manpage-renames \ Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? Cheers, Richard
-----Original Message----- From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Richard Purdie via lists.openembedded.org Sent: Monday, October 9, 2023 18:44 To: Marek Vasut <marex@denx.de>; steve@sakoman.com; openembedded-core@lists.openembedded.org Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 > On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: > > Configure with "--disable-root-environ" to disallow loading of custom > > terminfo entries in setuid/setgid programs, mitigating the impact of > > CVE-2023-29491. > > > > This is taken from debian: > > https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b > > 8780d51cd09bd5a08ac > > > > Signed-off-by: Marek Vasut <marex@denx.de> > > --- > > Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> > > Cc: Richard Purdie <richard.purdie@linuxfoundation.org> > > --- > > meta/recipes-core/ncurses/ncurses.inc | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/meta/recipes-core/ncurses/ncurses.inc > > b/meta/recipes-core/ncurses/ncurses.inc > > index 367f3b19f4..1bc07ec2d4 100644 > > --- a/meta/recipes-core/ncurses/ncurses.inc > > +++ b/meta/recipes-core/ncurses/ncurses.inc > > @@ -87,6 +87,7 @@ ncurses_configure() { > > --enable-sigwinch \ > > --enable-pc-files \ > > --disable-rpath-hack \ > > + --disable-root-environ \ > > ${EXCONFIG_ARGS} \ > > --with-manpage-format=normal \ > > --without-manpage-renames \ > > Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? ncurses 6.4 is not affected and not shown in CVE report, not sure why this is submitted for master. Peter > > Cheers, > > Richard
On 10/9/23 18:51, Marko, Peter wrote: > -----Original Message----- > From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Richard Purdie via lists.openembedded.org > Sent: Monday, October 9, 2023 18:44 > To: Marek Vasut <marex@denx.de>; steve@sakoman.com; openembedded-core@lists.openembedded.org > Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> > Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 > >> On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: >>> Configure with "--disable-root-environ" to disallow loading of custom >>> terminfo entries in setuid/setgid programs, mitigating the impact of >>> CVE-2023-29491. >>> >>> This is taken from debian: >>> https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b >>> 8780d51cd09bd5a08ac >>> >>> Signed-off-by: Marek Vasut <marex@denx.de> >>> --- >>> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> >>> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> >>> --- >>> meta/recipes-core/ncurses/ncurses.inc | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/meta/recipes-core/ncurses/ncurses.inc >>> b/meta/recipes-core/ncurses/ncurses.inc >>> index 367f3b19f4..1bc07ec2d4 100644 >>> --- a/meta/recipes-core/ncurses/ncurses.inc >>> +++ b/meta/recipes-core/ncurses/ncurses.inc >>> @@ -87,6 +87,7 @@ ncurses_configure() { >>> --enable-sigwinch \ >>> --enable-pc-files \ >>> --disable-rpath-hack \ >>> + --disable-root-environ \ >>> ${EXCONFIG_ARGS} \ >>> --with-manpage-format=normal \ >>> --without-manpage-renames \ >> >> Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? > > ncurses 6.4 is not affected and not shown in CVE report, not sure why this is submitted for master. > Peter Just wanted to make sure the configuration is consistent across all the releases.
-----Original Message----- From: Marek Vasut <marex@denx.de> Sent: Monday, October 9, 2023 18:57 To: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>; richard.purdie@linuxfoundation.org Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>; steve@sakoman.com; openembedded-core@lists.openembedded.org Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 > On 10/9/23 18:51, Marko, Peter wrote: > > -----Original Message----- > > From: openembedded-core@lists.openembedded.org > > <openembedded-core@lists.openembedded.org> On Behalf Of Richard Purdie > > via lists.openembedded.org > > Sent: Monday, October 9, 2023 18:44 > > To: Marek Vasut <marex@denx.de>; steve@sakoman.com; > > openembedded-core@lists.openembedded.org > > Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> > > Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 > > > >> On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: > >>> Configure with "--disable-root-environ" to disallow loading of > >>> custom terminfo entries in setuid/setgid programs, mitigating the > >>> impact of CVE-2023-29491. > >>> > >>> This is taken from debian: > >>> https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef03 > >>> 9b > >>> 8780d51cd09bd5a08ac > >>> > >>> Signed-off-by: Marek Vasut <marex@denx.de> > >>> --- > >>> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> > >>> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> > >>> --- > >>> meta/recipes-core/ncurses/ncurses.inc | 1 + > >>> 1 file changed, 1 insertion(+) > >>> > >>> diff --git a/meta/recipes-core/ncurses/ncurses.inc > >>> b/meta/recipes-core/ncurses/ncurses.inc > >>> index 367f3b19f4..1bc07ec2d4 100644 > >>> --- a/meta/recipes-core/ncurses/ncurses.inc > >>> +++ b/meta/recipes-core/ncurses/ncurses.inc > >>> @@ -87,6 +87,7 @@ ncurses_configure() { > >>> --enable-sigwinch \ > >>> --enable-pc-files \ > >>> --disable-rpath-hack \ > >>> + --disable-root-environ \ > >>> ${EXCONFIG_ARGS} \ > >>> --with-manpage-format=normal \ > >>> --without-manpage-renames \ > >> > >> Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? > > > > ncurses 6.4 is not affected and not shown in CVE report, not sure why this is submitted for master. > > Peter > > Just wanted to make sure the configuration is consistent across all the releases. I think that the commit message should be changed. It's misleading when it only says that it mitigates already fixed CVE. Peter
On 10/9/23 19:27, Marko, Peter wrote: > -----Original Message----- > From: Marek Vasut <marex@denx.de> > Sent: Monday, October 9, 2023 18:57 > To: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>; richard.purdie@linuxfoundation.org > Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>; steve@sakoman.com; openembedded-core@lists.openembedded.org > Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 > >> On 10/9/23 18:51, Marko, Peter wrote: >>> -----Original Message----- >>> From: openembedded-core@lists.openembedded.org >>> <openembedded-core@lists.openembedded.org> On Behalf Of Richard Purdie >>> via lists.openembedded.org >>> Sent: Monday, October 9, 2023 18:44 >>> To: Marek Vasut <marex@denx.de>; steve@sakoman.com; >>> openembedded-core@lists.openembedded.org >>> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> >>> Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 >>> >>>> On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: >>>>> Configure with "--disable-root-environ" to disallow loading of >>>>> custom terminfo entries in setuid/setgid programs, mitigating the >>>>> impact of CVE-2023-29491. >>>>> >>>>> This is taken from debian: >>>>> https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef03 >>>>> 9b >>>>> 8780d51cd09bd5a08ac >>>>> >>>>> Signed-off-by: Marek Vasut <marex@denx.de> >>>>> --- >>>>> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> >>>>> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> >>>>> --- >>>>> meta/recipes-core/ncurses/ncurses.inc | 1 + >>>>> 1 file changed, 1 insertion(+) >>>>> >>>>> diff --git a/meta/recipes-core/ncurses/ncurses.inc >>>>> b/meta/recipes-core/ncurses/ncurses.inc >>>>> index 367f3b19f4..1bc07ec2d4 100644 >>>>> --- a/meta/recipes-core/ncurses/ncurses.inc >>>>> +++ b/meta/recipes-core/ncurses/ncurses.inc >>>>> @@ -87,6 +87,7 @@ ncurses_configure() { >>>>> --enable-sigwinch \ >>>>> --enable-pc-files \ >>>>> --disable-rpath-hack \ >>>>> + --disable-root-environ \ >>>>> ${EXCONFIG_ARGS} \ >>>>> --with-manpage-format=normal \ >>>>> --without-manpage-renames \ >>>> >>>> Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? >>> >>> ncurses 6.4 is not affected and not shown in CVE report, not sure why this is submitted for master. >>> Peter >> >> Just wanted to make sure the configuration is consistent across all the releases. > > I think that the commit message should be changed. > It's misleading when it only says that it mitigates already fixed CVE. Will do, how does this sound: " ncurses: disallow loading of custom terminfo entries in setuid/setgid programs Configure with "--disable-root-environ" to disallow loading of custom terminfo entries in setuid/setgid programs. This is related to CVE-2023-29491, even though CVE-2023-29491 itself is fixed in this OE release by a backport patch. This is taken from debian: https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b8780d51cd09bd5a08ac " ?
On 10/9/23 18:44, Richard Purdie wrote: > On Mon, 2023-10-09 at 18:31 +0200, Marek Vasut wrote: >> Configure with "--disable-root-environ" to disallow loading of >> custom terminfo entries in setuid/setgid programs, mitigating the >> impact of CVE-2023-29491. >> >> This is taken from debian: >> https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b8780d51cd09bd5a08ac >> >> Signed-off-by: Marek Vasut <marex@denx.de> >> --- >> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> >> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> >> --- >> meta/recipes-core/ncurses/ncurses.inc | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/meta/recipes-core/ncurses/ncurses.inc b/meta/recipes-core/ncurses/ncurses.inc >> index 367f3b19f4..1bc07ec2d4 100644 >> --- a/meta/recipes-core/ncurses/ncurses.inc >> +++ b/meta/recipes-core/ncurses/ncurses.inc >> @@ -87,6 +87,7 @@ ncurses_configure() { >> --enable-sigwinch \ >> --enable-pc-files \ >> --disable-rpath-hack \ >> + --disable-root-environ \ >> ${EXCONFIG_ARGS} \ >> --with-manpage-format=normal \ >> --without-manpage-renames \ > > Should the patch add a CVE_STATUS entry as well so the cve tooling can > tell we've mitigated this? I think I will try to backport the actual fix for this CVE from Kirkstone first.
-----Original Message----- From: Marek Vasut <marex@denx.de> Sent: Monday, October 9, 2023 21:28 To: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>; richard.purdie@linuxfoundation.org Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>; steve@sakoman.com; openembedded-core@lists.openembedded.org Subject: Re: [OE-core] [PATCH] ncurses: Mitigate CVE-2023-29491 <snip> > >>>> > >>>> Should the patch add a CVE_STATUS entry as well so the cve tooling can tell we've mitigated this? > >>> > >>> ncurses 6.4 is not affected and not shown in CVE report, not sure why this is submitted for master. > >>> Peter > >> > >> Just wanted to make sure the configuration is consistent across all the releases. > > > > I think that the commit message should be changed. > > It's misleading when it only says that it mitigates already fixed CVE. > > Will do, how does this sound: > > " > ncurses: disallow loading of custom terminfo entries in setuid/setgid programs > > Configure with "--disable-root-environ" to disallow loading of > custom terminfo entries in setuid/setgid programs. This is related > to CVE-2023-29491, even though CVE-2023-29491 itself is fixed in > this OE release by a backport patch. > > This is taken from debian: > > https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b8780d51cd09bd5a08ac Parent commit - https://salsa.debian.org/debian/ncurses/-/commit/93a383681e3da9f385536f9bc98266c5dd7e42cf > " > > ? The commit message seems to be fine now, but... ...looking at Debian, they first changed behavior of "--disable-root-environ" option via custom patch and only afterwards used it. Since Yocto is not changing the behavior of this option, it is probably a wrong thing to enable it by default. This would need a much deeper analysis imho, for all three branches where this is submitted. Peter
diff --git a/meta/recipes-core/ncurses/ncurses.inc b/meta/recipes-core/ncurses/ncurses.inc index 367f3b19f4..1bc07ec2d4 100644 --- a/meta/recipes-core/ncurses/ncurses.inc +++ b/meta/recipes-core/ncurses/ncurses.inc @@ -87,6 +87,7 @@ ncurses_configure() { --enable-sigwinch \ --enable-pc-files \ --disable-rpath-hack \ + --disable-root-environ \ ${EXCONFIG_ARGS} \ --with-manpage-format=normal \ --without-manpage-renames \
Configure with "--disable-root-environ" to disallow loading of custom terminfo entries in setuid/setgid programs, mitigating the impact of CVE-2023-29491. This is taken from debian: https://salsa.debian.org/debian/ncurses/-/commit/1c530aad772f7aeef039b8780d51cd09bd5a08ac Signed-off-by: Marek Vasut <marex@denx.de> --- Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> --- meta/recipes-core/ncurses/ncurses.inc | 1 + 1 file changed, 1 insertion(+)