Message ID | 20231009162700.94188-1-marex@denx.de |
---|---|
State | Accepted, archived |
Delegated to: | Steve Sakoman |
Headers | show |
Series | [dunfell] gawk: Backport CVE-2023-4156 fix | expand |
On Mon, Oct 9, 2023 at 6:27 AM Marek Vasut <marex@denx.de> wrote: > > Pick fix for CVE-2023-4156 from ubuntu 20.04 > > A heap out-of-bounds read flaw was found in builtin.c in the gawk > package. This issue may lead to a crash and could be used to read > sensitive information. > > https://nvd.nist.gov/vuln/detail/CVE-2023-4156 > > https://packages.ubuntu.com/source/focal/gawk > gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f > > Signed-off-by: Marek Vasut <marex@denx.de> > --- > .../gawk/gawk/CVE-2023-4156.patch | 26 +++++++++++++++++++ > meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 + > 2 files changed, 27 insertions(+) > create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch > > diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch > new file mode 100644 > index 0000000000..ecfd974af0 > --- /dev/null > +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch > @@ -0,0 +1,26 @@ > +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001 > +From: "Arnold D. Robbins" <arnold@skeeve.com> > +Date: Wed, 3 Aug 2022 13:00:54 +0300 > +Subject: [PATCH] Smal bug fix in builtin.c. > + > +CVE: CVE-2023-4156 Missing Upstream-Status. Note that ubuntu isn't upstream so please link to upstream gawk commit. Thanks! Steve > +Signed-off-by: Marek Vasut <marex@denx.de> > +--- > + ChangeLog | 6 ++++++ > + builtin.c | 5 ++++- > + 2 files changed, 10 insertions(+), 1 deletion(-) > + > +--- gawk-5.1.0.orig/builtin.c > ++++ gawk-5.1.0/builtin.c > +@@ -957,7 +957,10 @@ check_pos: > + s1++; > + n0--; > + } > +- if (val >= num_args) { > ++ // val could be less than zero if someone provides a field width > ++ // so large that it causes integer overflow. Mainly fuzzers do this, > ++ // but let's try to be good anyway. > ++ if (val < 0 || val >= num_args) { > + toofew = true; > + break; > + } > diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb > index 1b29ec3113..7ca4cb77e4 100644 > --- a/meta/recipes-extended/gawk/gawk_5.0.1.bb > +++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb > @@ -17,6 +17,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr" > > SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \ > file://remove-sensitive-tests.patch \ > + file://CVE-2023-4156.patch \ > file://run-ptest \ > " > > -- > 2.40.1 >
On 10/9/23 19:29, Steve Sakoman wrote: > On Mon, Oct 9, 2023 at 6:27 AM Marek Vasut <marex@denx.de> wrote: >> >> Pick fix for CVE-2023-4156 from ubuntu 20.04 >> >> A heap out-of-bounds read flaw was found in builtin.c in the gawk >> package. This issue may lead to a crash and could be used to read >> sensitive information. >> >> https://nvd.nist.gov/vuln/detail/CVE-2023-4156 >> >> https://packages.ubuntu.com/source/focal/gawk >> gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f >> >> Signed-off-by: Marek Vasut <marex@denx.de> >> --- >> .../gawk/gawk/CVE-2023-4156.patch | 26 +++++++++++++++++++ >> meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 + >> 2 files changed, 27 insertions(+) >> create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch >> >> diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch >> new file mode 100644 >> index 0000000000..ecfd974af0 >> --- /dev/null >> +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch >> @@ -0,0 +1,26 @@ >> +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001 >> +From: "Arnold D. Robbins" <arnold@skeeve.com> >> +Date: Wed, 3 Aug 2022 13:00:54 +0300 >> +Subject: [PATCH] Smal bug fix in builtin.c. >> + >> +CVE: CVE-2023-4156 > > Missing Upstream-Status. Note that ubuntu isn't upstream so please > link to upstream gawk commit. Should be fixed in V2, sorry for the mess.
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch new file mode 100644 index 0000000000..ecfd974af0 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch @@ -0,0 +1,26 @@ +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" <arnold@skeeve.com> +Date: Wed, 3 Aug 2022 13:00:54 +0300 +Subject: [PATCH] Smal bug fix in builtin.c. + +CVE: CVE-2023-4156 +Signed-off-by: Marek Vasut <marex@denx.de> +--- + ChangeLog | 6 ++++++ + builtin.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- gawk-5.1.0.orig/builtin.c ++++ gawk-5.1.0/builtin.c +@@ -957,7 +957,10 @@ check_pos: + s1++; + n0--; + } +- if (val >= num_args) { ++ // val could be less than zero if someone provides a field width ++ // so large that it causes integer overflow. Mainly fuzzers do this, ++ // but let's try to be good anyway. ++ if (val < 0 || val >= num_args) { + toofew = true; + break; + } diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb index 1b29ec3113..7ca4cb77e4 100644 --- a/meta/recipes-extended/gawk/gawk_5.0.1.bb +++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb @@ -17,6 +17,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr" SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \ file://remove-sensitive-tests.patch \ + file://CVE-2023-4156.patch \ file://run-ptest \ "
Pick fix for CVE-2023-4156 from ubuntu 20.04 A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. https://nvd.nist.gov/vuln/detail/CVE-2023-4156 https://packages.ubuntu.com/source/focal/gawk gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f Signed-off-by: Marek Vasut <marex@denx.de> --- .../gawk/gawk/CVE-2023-4156.patch | 26 +++++++++++++++++++ meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 + 2 files changed, 27 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch