From patchwork Tue Dec 12 22:40:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 36126 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4D31C4167B for ; Tue, 12 Dec 2023 22:40:36 +0000 (UTC) Received: from mail-oa1-f53.google.com (mail-oa1-f53.google.com [209.85.160.53]) by mx.groups.io with SMTP id smtpd.web10.10216.1702420832566303278 for ; Tue, 12 Dec 2023 14:40:32 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=Byql7DN9; spf=softfail (domain: sakoman.com, ip: 209.85.160.53, mailfrom: steve@sakoman.com) Received: by mail-oa1-f53.google.com with SMTP id 586e51a60fabf-1f055438492so4645795fac.3 for ; Tue, 12 Dec 2023 14:40:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1702420831; x=1703025631; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=Ig6r9SqbmRc2Jglv6mBsVrbU20aECoPkGP+/JpjuBz0=; b=Byql7DN96DMBOFbbbjBndD6MUdxRdZs6FmvmenfTW5MWVLHEGQFpvMOk/PQKm0LywU ZNrruC7LcPVlwoyv7z2ehfbV22FJJJl6HG0VoN2L6vAqsm8lEm0Uz3OFYv7yWNjdTAyb lOVbJxr7V77CES+HhkSlZMNb2satq3z8SSjitlV7kjDjCo1uVPNVgnupRT9UVYsr1vEj 3IfXd5/D1kLb3YHgD4H9JJQF8jqKIrqUBnThiRbxAXv0HlDwqOU69MVJWZlvgHohzPgO Pm07khOUcKTaR30VTAn00s4oCEAMBrApYq2NOzEwrBSSvrAAeMsNk5xiQ7KkBv8sbBVh CiVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702420831; x=1703025631; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Ig6r9SqbmRc2Jglv6mBsVrbU20aECoPkGP+/JpjuBz0=; b=Yn1ibS1bv0RUscg1CxKe/NHVJs6+6nOvU1hzo4ryp8t1qP/JH9aobppfvT3jyuEJf8 RRZuRM+3rIVDc7dwpgSQJ7ULi/s8qJvxjUqOeX7KXBOgjHRG7CATITosKFfTQwcnPGsI LmuJMbpGnOsHI/U5fMSp3th5tQ76pZsJhCAlLosUL2zHI+bwLC6UowArWOrqQovkMkoQ sxoV04dE9r6NhyRi/dcS1ajL5LJAyx8hsnMAXrPrqr7RgkhCwzwF0TkCNEVO6Kje1N2b wfpQpK/cvi+MF+eyRxVl+uAy837jmF6PNR0cjPNebfQOgB2mWC6YoSHTAvuUyTI+3sq7 w/RA== X-Gm-Message-State: AOJu0Yy6WboIrb/sP5gIwfjk1R/Z8VfVvfgyfMd9/LZYt86AbwrWtqLG w4ILlWfY/KWomwf2WC4sbOk9Y5hpqViSoq8bt28= X-Google-Smtp-Source: AGHT+IHlfdC0jy/USbD0tUtIViJCD64dSEo002QclgIn8v5wiDsCqcCB8w7+ybU52+d519gKU3aeYA== X-Received: by 2002:a05:6870:d88c:b0:1fb:75b:12f1 with SMTP id oe12-20020a056870d88c00b001fb075b12f1mr8687957oac.67.1702420831262; Tue, 12 Dec 2023 14:40:31 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-234-108-41.hawaiiantel.net. [72.234.108.41]) by smtp.gmail.com with ESMTPSA id g25-20020aa78759000000b006d0951e74cbsm3847974pfo.178.2023.12.12.14.40.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 14:40:30 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 1/5] avahi: backport CVE-2023-1981 & CVE's follow-up patches Date: Tue, 12 Dec 2023 12:40:16 -1000 Message-Id: <06b6a5cc9be0cb4a1fedc911a8a7edbbc75e4471.1702420654.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 12 Dec 2023 22:40:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192247 From: Vijay Anusuri import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469-2 CVE-2023-38470-2 CVE-2023-38471-2 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] Ref: https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/nanbield-nut&id=a9203c46cd64c3ec5e5b00e381bbac85733f85df Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman --- meta/recipes-connectivity/avahi/avahi_0.8.bb | 10 ++- .../avahi/files/CVE-2023-1981.patch | 58 +++++++++++++++++ ...023-38469.patch => CVE-2023-38469-1.patch} | 0 .../avahi/files/CVE-2023-38469-2.patch | 65 +++++++++++++++++++ ...023-38470.patch => CVE-2023-38470-1.patch} | 0 .../avahi/files/CVE-2023-38470-2.patch | 52 +++++++++++++++ ...023-38471.patch => CVE-2023-38471-1.patch} | 0 .../avahi/files/CVE-2023-38471-2.patch | 52 +++++++++++++++ .../avahi/files/CVE-2023-38472.patch | 44 ++++++------- 9 files changed, 256 insertions(+), 25 deletions(-) create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch rename meta/recipes-connectivity/avahi/files/{CVE-2023-38469.patch => CVE-2023-38469-1.patch} (100%) create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch rename meta/recipes-connectivity/avahi/files/{CVE-2023-38470.patch => CVE-2023-38470-1.patch} (100%) create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch rename meta/recipes-connectivity/avahi/files/{CVE-2023-38471.patch => CVE-2023-38471-1.patch} (100%) create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb index af5284a252..5d1c86978a 100644 --- a/meta/recipes-connectivity/avahi/avahi_0.8.bb +++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb @@ -26,9 +26,13 @@ SRC_URI = "https://github.com/lathiat/avahi/releases/download/v${PV}/avahi-${PV} file://0001-Fix-opening-etc-resolv.conf-error.patch \ file://handle-hup.patch \ file://local-ping.patch \ - file://CVE-2023-38471.patch \ - file://CVE-2023-38470.patch \ - file://CVE-2023-38469.patch \ + file://CVE-2023-1981.patch \ + file://CVE-2023-38469-1.patch \ + file://CVE-2023-38469-2.patch \ + file://CVE-2023-38470-1.patch \ + file://CVE-2023-38470-2.patch \ + file://CVE-2023-38471-1.patch \ + file://CVE-2023-38471-2.patch \ file://CVE-2023-38472.patch \ file://CVE-2023-38473.patch \ " diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch new file mode 100644 index 0000000000..4d7924d13a --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch @@ -0,0 +1,58 @@ +From a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 17 Nov 2022 01:51:53 +0100 +Subject: [PATCH] Emit error if requested service is not found + +It currently just crashes instead of replying with error. Check return +value and emit error instead of passing NULL pointer to reply. + +Fixes #375 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-1981.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f] +CVE: CVE-2023-1981 +Signed-off-by: Vijay Anusuri +--- + avahi-daemon/dbus-protocol.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/avahi-daemon/dbus-protocol.c b/avahi-daemon/dbus-protocol.c +index 70d7687bc..406d0b441 100644 +--- a/avahi-daemon/dbus-protocol.c ++++ b/avahi-daemon/dbus-protocol.c +@@ -375,10 +375,14 @@ static DBusHandlerResult dbus_get_alternative_host_name(DBusConnection *c, DBusM + } + + t = avahi_alternative_host_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Hostname not found"); ++ } + } + + static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DBusMessage *m, DBusError *error) { +@@ -389,10 +393,14 @@ static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DB + } + + t = avahi_alternative_service_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Service not found"); ++ } + } + + static DBusHandlerResult dbus_create_new_entry_group(DBusConnection *c, DBusMessage *m, DBusError *error) { diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38469.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch similarity index 100% rename from meta/recipes-connectivity/avahi/files/CVE-2023-38469.patch rename to meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch new file mode 100644 index 0000000000..f8f60ddca1 --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch @@ -0,0 +1,65 @@ +From c6cab87df290448a63323c8ca759baa516166237 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin +Date: Wed, 25 Oct 2023 18:15:42 +0000 +Subject: [PATCH] tests: pass overly long TXT resource records + +to make sure they don't crash avahi any more. +It reproduces https://github.com/lathiat/avahi/issues/455 + +Canonical notes: +nickgalanis> removed first hunk since there is no .github dir in this release + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38469-2.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237] +CVE: CVE-2023-38469 +Signed-off-by: Vijay Anusuri +--- + avahi-client/client-test.c | 14 ++++++++++++++ + 1 files changed, 14 insertions(+) + +Index: avahi-0.8/avahi-client/client-test.c +=================================================================== +--- avahi-0.8.orig/avahi-client/client-test.c ++++ avahi-0.8/avahi-client/client-test.c +@@ -22,6 +22,7 @@ + #endif + + #include ++#include + #include + + #include +@@ -33,6 +34,8 @@ + #include + #include + ++#include ++ + static const AvahiPoll *poll_api = NULL; + static AvahiSimplePoll *simple_poll = NULL; + +@@ -222,6 +225,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + uint32_t cookie; + struct timeval tv; + AvahiAddress a; ++ uint8_t rdata[AVAHI_DNS_RDATA_MAX+1]; ++ AvahiStringList *txt = NULL; ++ int r; + + simple_poll = avahi_simple_poll_new(); + poll_api = avahi_simple_poll_get(simple_poll); +@@ -258,6 +264,14 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL))); + printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6)); + ++ memset(rdata, 1, sizeof(rdata)); ++ r = avahi_string_list_parse(rdata, sizeof(rdata), &txt); ++ assert(r >= 0); ++ assert(avahi_string_list_serialize(txt, NULL, 0) == sizeof(rdata)); ++ error = avahi_entry_group_add_service_strlst(group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", "_qotd._tcp", NULL, NULL, 123, txt); ++ assert(error == AVAHI_ERR_INVALID_RECORD); ++ avahi_string_list_free(txt); ++ + avahi_entry_group_commit (group); + + domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u"); diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38470.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch similarity index 100% rename from meta/recipes-connectivity/avahi/files/CVE-2023-38470.patch rename to meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch new file mode 100644 index 0000000000..e0736bf210 --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch @@ -0,0 +1,52 @@ +From 20dec84b2480821704258bc908e7b2bd2e883b24 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin +Date: Tue, 19 Sep 2023 03:21:25 +0000 +Subject: [PATCH] [common] bail out when escaped labels can't fit into ret + +Fixes: +``` +==93410==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9e76f14c16 at pc 0x00000047208d bp 0x7ffee90a6a00 sp 0x7ffee90a61c8 +READ of size 1110 at 0x7f9e76f14c16 thread T0 + #0 0x47208c in __interceptor_strlen (out/fuzz-domain+0x47208c) (BuildId: 731b20c1eef22c2104e75a6496a399b10cfc7cba) + #1 0x534eb0 in avahi_strdup avahi/avahi-common/malloc.c:167:12 + #2 0x53862c in avahi_normalize_name_strdup avahi/avahi-common/domain.c:226:12 +``` +and +``` +fuzz-domain: fuzz/fuzz-domain.c:38: int LLVMFuzzerTestOneInput(const uint8_t *, size_t): Assertion `avahi_domain_equal(s, t)' failed. +==101571== ERROR: libFuzzer: deadly signal + #0 0x501175 in __sanitizer_print_stack_trace (/home/vagrant/avahi/out/fuzz-domain+0x501175) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #1 0x45ad2c in fuzzer::PrintStackTrace() (/home/vagrant/avahi/out/fuzz-domain+0x45ad2c) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #2 0x43fc07 in fuzzer::Fuzzer::CrashCallback() (/home/vagrant/avahi/out/fuzz-domain+0x43fc07) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #3 0x7f1581d7ebaf (/lib64/libc.so.6+0x3dbaf) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #4 0x7f1581dcf883 in __pthread_kill_implementation (/lib64/libc.so.6+0x8e883) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #5 0x7f1581d7eafd in gsignal (/lib64/libc.so.6+0x3dafd) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #6 0x7f1581d6787e in abort (/lib64/libc.so.6+0x2687e) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #7 0x7f1581d6779a in __assert_fail_base.cold (/lib64/libc.so.6+0x2679a) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #8 0x7f1581d77186 in __assert_fail (/lib64/libc.so.6+0x36186) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #9 0x5344a4 in LLVMFuzzerTestOneInput /home/vagrant/avahi/fuzz/fuzz-domain.c:38:9 +``` + +It's a follow-up to 94cb6489114636940ac683515417990b55b5d66c + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38470-2.patch?h=ubuntu/jammy-security +CVE: CVE-2023-38470 #Follow-up patch +Signed-off-by: Vijay Anusuri +--- + avahi-common/domain.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +Index: avahi-0.8/avahi-common/domain.c +=================================================================== +--- avahi-0.8.orig/avahi-common/domain.c ++++ avahi-0.8/avahi-common/domain.c +@@ -210,7 +210,8 @@ char *avahi_normalize_name(const char *s + } else + empty = 0; + +- avahi_escape_label(label, strlen(label), &r, &size); ++ if (!(avahi_escape_label(label, strlen(label), &r, &size))) ++ return NULL; + } + + return ret_s; diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38471.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch similarity index 100% rename from meta/recipes-connectivity/avahi/files/CVE-2023-38471.patch rename to meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch new file mode 100644 index 0000000000..44737bfc2e --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch @@ -0,0 +1,52 @@ +From b675f70739f404342f7f78635d6e2dcd85a13460 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin +Date: Tue, 24 Oct 2023 22:04:51 +0000 +Subject: [PATCH] core: return errors from avahi_server_set_host_name properly + +It's a follow-up to 894f085f402e023a98cbb6f5a3d117bd88d93b09 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38471-2.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] +CVE: CVE-2023-38471 #Follow-up Patch +Signed-off-by: Vijay Anusuri +--- + avahi-core/server.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +Index: avahi-0.8/avahi-core/server.c +=================================================================== +--- avahi-0.8.orig/avahi-core/server.c ++++ avahi-0.8/avahi-core/server.c +@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServ + else + hn = avahi_normalize_name_strdup(host_name); + ++ if (!hn) ++ return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY); ++ + h = hn; + if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) { + avahi_free(h); +- return AVAHI_ERR_INVALID_HOST_NAME; ++ return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME); + } + + avahi_free(h); +@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServ + h = label_escaped; + len = sizeof(label_escaped); + if (!avahi_escape_label(label, strlen(label), &h, &len)) +- return AVAHI_ERR_INVALID_HOST_NAME; ++ return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME); + + if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION) + return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE); +@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServ + avahi_free(s->host_name); + s->host_name = avahi_strdup(label_escaped); + if (!s->host_name) +- return AVAHI_ERR_NO_MEMORY; ++ return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY); + + update_fqdn(s); + diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch index 2f172622c9..85dbded73b 100644 --- a/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch @@ -1,46 +1,46 @@ -From 4e2537500dd0a1333845482f1f4147ef906030dd Mon Sep 17 00:00:00 2001 +From b024ae5749f4aeba03478e6391687c3c9c8dee40 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Thu, 19 Oct 2023 17:36:44 +0200 -Subject: [PATCH]core: make sure there is rdata to process before - parsing it +Subject: [PATCH] core: make sure there is rdata to process before parsing it Fixes #452 -Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40] -CVE: CVE-2023-38472 +CVE-2023-38472 +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38472.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40] +CVE: CVE-2023-38472 Signed-off-by: Meenali Gupta +Signed-off-by: Vijay Anusuri --- avahi-client/client-test.c | 3 +++ avahi-daemon/dbus-entry-group.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) -diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c -index 7d04a6a..57750a4 100644 ---- a/avahi-client/client-test.c -+++ b/avahi-client/client-test.c -@@ -258,6 +258,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) { - printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL))); - printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6)); - +Index: avahi-0.8/avahi-client/client-test.c +=================================================================== +--- avahi-0.8.orig/avahi-client/client-test.c ++++ avahi-0.8/avahi-client/client-test.c +@@ -272,6 +272,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + assert(error == AVAHI_ERR_INVALID_RECORD); + avahi_string_list_free(txt); + + error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0); + assert(error != AVAHI_OK); + avahi_entry_group_commit (group); - + domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u"); -diff --git a/avahi-daemon/dbus-entry-group.c b/avahi-daemon/dbus-entry-group.c -index 4e879a5..aa23d4b 100644 ---- a/avahi-daemon/dbus-entry-group.c -+++ b/avahi-daemon/dbus-entry-group.c -@@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_group_impl(DBusConnection *c, DBusMessage +Index: avahi-0.8/avahi-daemon/dbus-entry-group.c +=================================================================== +--- avahi-0.8.orig/avahi-daemon/dbus-entry-group.c ++++ avahi-0.8/avahi-daemon/dbus-entry-group.c +@@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_g if (!(r = avahi_record_new_full (name, clazz, type, ttl))) return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL); - + - if (avahi_rdata_parse (r, rdata, size) < 0) { + if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) { avahi_record_unref (r); return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL); } --- -2.40.0 From patchwork Tue Dec 12 22:40:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 36127 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0652C4167D for ; Tue, 12 Dec 2023 22:40:36 +0000 (UTC) Received: from mail-oi1-f172.google.com (mail-oi1-f172.google.com [209.85.167.172]) by mx.groups.io with SMTP id smtpd.web11.9986.1702420834557487771 for ; Tue, 12 Dec 2023 14:40:34 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=csHqcVPa; spf=softfail (domain: sakoman.com, ip: 209.85.167.172, mailfrom: steve@sakoman.com) Received: by mail-oi1-f172.google.com with SMTP id 5614622812f47-3b9ef61b6b8so3639266b6e.3 for ; Tue, 12 Dec 2023 14:40:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1702420833; x=1703025633; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=n2otXZpcWYzuQNHcvUD/t71z8HfyaYYISLJL6Xn32oE=; b=csHqcVPaCqclHFPInvCQV+proaFW4E8qi8t7vBrkkaGjK508Hq6CN0uYDlhkhEzd6P 5CFfaZoi77HF73zEtd/afecUyM0e91MU6nhqmS+FLmqhidUZrOETnVLoVq7FRXbOdReN uRic2A7VH0OeHAxa/hKZBT6o3WMJ5k4Pp5tQ1z39Be3uyE1+3C9x39UKdfHb5NXG6d9B e/5mDcR6IKg2PidB7OL6F/3KtTf8tetucpa3GmIb30Jl2zTaVqUnbUzn0NKWau002wqD Ez342Bwsn2FEF9H2n3iAJiedG4dbJKk2kr7hn8SUH6Zo1zOtLqAGqzWH+YHkhlcE73PV eltg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702420833; x=1703025633; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n2otXZpcWYzuQNHcvUD/t71z8HfyaYYISLJL6Xn32oE=; b=nZKUqsU/f2k3XZR7qklHYy+EqtHI2pMamYWJaHiQAnmRusv1HvRbqPocGYQU1kZGmc VcztAHt9xL8l1oiQrxUvbyAmpt8Bbh1hVU1dyx9ZgnYYbT4Rrw52a5robaKRtifRVz4+ qEH4Q4vp14ULszPGH5RaylqKoodv+bACSJ1CiLaF7QRpd9OVHldZns0GFpFZN72ypMWz UBXDARXhxRcIBHQ1zDwWN2dF+7t5Pkd0hiqYLxOtSA1WHi74Az2jwIYNgEr2DvXy9Evo zcLYJjB6ZQ5JUH0zXUqdKo0tNIDGPfPeUcFZkHTO0qTKlwbjzjwXy/XB9moLy8wcHjhP MMNQ== X-Gm-Message-State: AOJu0Yzv/cmcd05yyu4/ISkCQJt01vXcYvM5CkiRtQhfNV6FjlbIdCTo P+aIvSZvbxXB+xBpQ+S95WSW/fZcCXLzTDDSKdM= X-Google-Smtp-Source: AGHT+IEEHDAmRDiLlBwXLSi7L5oAmt6t8VvojkuiTUy0fPEUPmF0ldLGEPsetBGlYm+d/NrGKs4RWA== X-Received: by 2002:a05:6808:14d5:b0:3b9:e3d7:1271 with SMTP id f21-20020a05680814d500b003b9e3d71271mr9395816oiw.9.1702420833121; Tue, 12 Dec 2023 14:40:33 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-234-108-41.hawaiiantel.net. [72.234.108.41]) by smtp.gmail.com with ESMTPSA id g25-20020aa78759000000b006d0951e74cbsm3847974pfo.178.2023.12.12.14.40.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 14:40:32 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 2/5] bluez5: fix CVE-2023-45866 Date: Tue, 12 Dec 2023 12:40:17 -1000 Message-Id: <0d62a7279dc14f4d2c1a57320381ca2d6cee7cff.1702420654.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 12 Dec 2023 22:40:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192248 From: Archana Polampalli Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports,potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45866 Upstream patches: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + .../bluez5/bluez5/CVE-2023-45866.patch | 56 +++++++++++++++++++ 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index a8eaba1dd6..7786b65670 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -54,6 +54,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '', 'file://0001-Allow-using-obexd-without-systemd-in-the-user-sessio.patch', d)} \ file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \ file://0001-test-gatt-Fix-hung-issue.patch \ + file://CVE-2023-45866.patch \ " S = "${WORKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch b/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch new file mode 100644 index 0000000000..5bb31d866a --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch @@ -0,0 +1,56 @@ +From 25a471a83e02e1effb15d5a488b3f0085eaeb675 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 10 Oct 2023 13:03:12 -0700 +Subject: [PATCH] input.conf: Change default of ClassicBondedOnly + +This changes the default of ClassicBondedOnly since defaulting to false +is not inline with HID specification which mandates the of Security Mode +4: + +BLUETOOTH SPECIFICATION Page 84 of 123 +Human Interface Device (HID) Profile: + + 5.4.3.4.2 Security Modes + Bluetooth HID Hosts shall use Security Mode 4 when interoperating with + Bluetooth HID devices that are compliant to the Bluetooth Core + Specification v2.1+EDR[6]. + +Upstream-Status: Backport +[https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675] + +CVE: CVE-2023-45866 + +Signed-off-by: Archana Polampalli +--- + profiles/input/device.c | 2 +- + profiles/input/input.conf | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/profiles/input/device.c b/profiles/input/device.c +index 4a50ea9..4310dd1 100644 +--- a/profiles/input/device.c ++++ b/profiles/input/device.c +@@ -81,7 +81,7 @@ struct input_device { + + static int idle_timeout = 0; + static bool uhid_enabled = false; +-static bool classic_bonded_only = false; ++static bool classic_bonded_only = true; + + void input_set_idle_timeout(int timeout) + { +diff --git a/profiles/input/input.conf b/profiles/input/input.conf +index 4c70bc5..d8645f3 100644 +--- a/profiles/input/input.conf ++++ b/profiles/input/input.conf +@@ -17,7 +17,7 @@ + # platforms may want to make sure that input connections only come from bonded + # device connections. Several older mice have been known for not supporting + # pairing/encryption. +-# Defaults to false to maximize device compatibility. ++# Defaults to true for security. + #ClassicBondedOnly=true + + # LE upgrade security +-- +2.40.0 From patchwork Tue Dec 12 22:40:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 36128 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD49CC35274 for ; Tue, 12 Dec 2023 22:40:36 +0000 (UTC) Received: from mail-oi1-f173.google.com (mail-oi1-f173.google.com [209.85.167.173]) by mx.groups.io with SMTP id smtpd.web10.10217.1702420836278802708 for ; Tue, 12 Dec 2023 14:40:36 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=AE8QgegQ; spf=softfail (domain: sakoman.com, ip: 209.85.167.173, mailfrom: steve@sakoman.com) Received: by mail-oi1-f173.google.com with SMTP id 5614622812f47-3b9f111c114so2892676b6e.1 for ; Tue, 12 Dec 2023 14:40:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1702420835; x=1703025635; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=w+GrvasqrhEEz08lO+XbXSA0sLxwDyuNjo6TD/ci7ok=; b=AE8QgegQ1fMrAXk/cbQRGCa/jHwMypwecxM1zfB+HnbPJCyhatSMD3ozkZdqwiNyYz rl4/ircU3XPPIxKZ8IEnB1tr2Dj5xX/DhT14H75zsv2AWSVT/Udk4ABxlcB3356APatA R03PaIP50Oaa6oyorNluJkBKtOXCLLNoKJFqh1PxPbuqXW7Ur7tb01ifUhspiztKvM+l EOZQsM5ehZ8UqmOu4CZrt+N2/UDEUH3gcrr+J42lY2VZ9idrM4d855ftc0elvx4oFj7T bdM5Tcu6MFlhUr7SVg01qoYEZRCV3vJjSQ9zxmI1VjkuyJRaxbzlJxuITI7FEL2MTPUO MTlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702420835; x=1703025635; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=w+GrvasqrhEEz08lO+XbXSA0sLxwDyuNjo6TD/ci7ok=; b=MbDqNJNRg7CgaIdpRbUfTXiATxJTN3GIDGUVC5WTgue5sFAuemZ9hucgvq5IaQX4pq HJM6L7bEjE0DTe9uKfSZOb/O5MzewW5j5EgmVs89tPu0JYLqySS4fjeM7ejnH0La5FAS nUB7MgW/0sS+4AziJENdkmZrI5xopIC8ZkqsId5hiYsNPWgQgem9OWr4uRhqDtq6M3Kq HSz6KwGaITipoTWXEGYzTYrscd7xasKWKUTkFLpVnebbeB4pxhyfxN8mQRMxp6ZLNi/z 34BroLHIz9X7JSdQ1L7Iay0eu93Ovg0erWrKxJGezeG1BRlIUirRsniez2/elDToqc+L NXBQ== X-Gm-Message-State: AOJu0YzpwcFw6poQfkLFs3HKThsnCGgEM2FJB3Boz9Er1h7FXJt1/JkN b0rLjEiKZJRyiHjria7QlRzhnutK2LtJeHZZ1AA= X-Google-Smtp-Source: AGHT+IEmqn6Csv8OHn25BL2xu3ZewxrgEYi+a4SCcf43EztfZyCYBVaRoIWn/ePJ3LkCU3xSfOW5EQ== X-Received: by 2002:a05:6808:1307:b0:3b9:ee89:541b with SMTP id y7-20020a056808130700b003b9ee89541bmr8369309oiv.28.1702420834774; Tue, 12 Dec 2023 14:40:34 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-234-108-41.hawaiiantel.net. [72.234.108.41]) by smtp.gmail.com with ESMTPSA id g25-20020aa78759000000b006d0951e74cbsm3847974pfo.178.2023.12.12.14.40.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 14:40:34 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 3/5] gnutls: Backport fix for CVE-2023-5981 Date: Tue, 12 Dec 2023 12:40:18 -1000 Message-Id: <626d267806841fae2423e8c595ec7c41dc91e6af.1702420654.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 12 Dec 2023 22:40:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192249 From: Vijay Anusuri Upstream-Status: Backport [import from debian https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.7.3-4ubuntu1.3/gnutls28_3.7.3-4ubuntu1.3.debian.tar.xz Upstream-Commit: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d] References: https://ubuntu.com/security/CVE-2023-5981 Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman --- .../gnutls/gnutls/CVE-2023-5981.patch | 206 ++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.7.4.bb | 1 + 2 files changed, 207 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch b/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch new file mode 100644 index 0000000000..33e498b8e5 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch @@ -0,0 +1,206 @@ +Backport of: + +From 29d6298d0b04cfff970b993915db71ba3f580b6d Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Mon, 23 Oct 2023 09:26:57 +0900 +Subject: [PATCH] auth/rsa_psk: side-step potential side-channel + +This removes branching that depends on secret data, porting changes +for regular RSA key exchange from +4804febddc2ed958e5ae774de2a8f85edeeff538 and +80a6ce8ddb02477cd724cd5b2944791aaddb702a. This also removes the +allow_wrong_pms as it was used sorely to control debug output +depending on the branching. + +Signed-off-by: Daiki Ueno + +Upstream-Status: Backport [import from debian https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.7.3-4ubuntu1.3/gnutls28_3.7.3-4ubuntu1.3.debian.tar.xz +Upstream-Commit: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d] +CVE: CVE-2023-5981 +Signed-off-by: Vijay Anusuri +--- + lib/auth/rsa.c | 2 +- + lib/auth/rsa_psk.c | 90 ++++++++++++++++++---------------------------- + lib/gnutls_int.h | 4 --- + lib/priority.c | 1 - + 4 files changed, 35 insertions(+), 62 deletions(-) + +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -207,7 +207,7 @@ proc_rsa_client_kx(gnutls_session_t sess + session->key.key.size); + /* After this point, any conditional on failure that cause differences + * in execution may create a timing or cache access pattern side +- * channel that can be used as an oracle, so treat very carefully */ ++ * channel that can be used as an oracle, so tread carefully */ + + /* Error handling logic: + * In case decryption fails then don't inform the peer. Just use the +--- a/lib/auth/rsa_psk.c ++++ b/lib/auth/rsa_psk.c +@@ -264,14 +264,13 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_se + { + gnutls_datum_t username; + psk_auth_info_t info; +- gnutls_datum_t plaintext; + gnutls_datum_t ciphertext; + gnutls_datum_t pwd_psk = { NULL, 0 }; + int ret, dsize; +- int randomize_key = 0; + ssize_t data_size = _data_size; + gnutls_psk_server_credentials_t cred; + gnutls_datum_t premaster_secret = { NULL, 0 }; ++ volatile uint8_t ver_maj, ver_min; + + cred = (gnutls_psk_server_credentials_t) + _gnutls_get_cred(session, GNUTLS_CRD_PSK); +@@ -327,71 +326,47 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_se + } + ciphertext.size = dsize; + +- ret = +- gnutls_privkey_decrypt_data(session->internals.selected_key, 0, +- &ciphertext, &plaintext); +- if (ret < 0 || plaintext.size != GNUTLS_MASTER_SIZE) { +- /* In case decryption fails then don't inform +- * the peer. Just use a random key. (in order to avoid +- * attack against pkcs-1 formatting). +- */ +- gnutls_assert(); +- _gnutls_debug_log +- ("auth_rsa_psk: Possible PKCS #1 format attack\n"); +- if (ret >= 0) { +- gnutls_free(plaintext.data); +- } +- randomize_key = 1; +- } else { +- /* If the secret was properly formatted, then +- * check the version number. +- */ +- if (_gnutls_get_adv_version_major(session) != +- plaintext.data[0] +- || (session->internals.allow_wrong_pms == 0 +- && _gnutls_get_adv_version_minor(session) != +- plaintext.data[1])) { +- /* No error is returned here, if the version number check +- * fails. We proceed normally. +- * That is to defend against the attack described in the paper +- * "Attacking RSA-based sessions in SSL/TLS" by Vlastimil Klima, +- * Ondej Pokorny and Tomas Rosa. +- */ +- gnutls_assert(); +- _gnutls_debug_log +- ("auth_rsa: Possible PKCS #1 version check format attack\n"); +- } +- } ++ ver_maj = _gnutls_get_adv_version_major(session); ++ ver_min = _gnutls_get_adv_version_minor(session); + ++ premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE); ++ if (premaster_secret.data == NULL) { ++ gnutls_assert(); ++ return GNUTLS_E_MEMORY_ERROR; ++ } ++ premaster_secret.size = GNUTLS_MASTER_SIZE; + +- if (randomize_key != 0) { +- premaster_secret.size = GNUTLS_MASTER_SIZE; +- premaster_secret.data = +- gnutls_malloc(premaster_secret.size); +- if (premaster_secret.data == NULL) { +- gnutls_assert(); +- return GNUTLS_E_MEMORY_ERROR; +- } +- +- /* we do not need strong random numbers here. +- */ +- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data, +- premaster_secret.size); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- } else { +- premaster_secret.data = plaintext.data; +- premaster_secret.size = plaintext.size; ++ /* Fallback value when decryption fails. Needs to be unpredictable. */ ++ ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data, ++ premaster_secret.size); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; + } + ++ gnutls_privkey_decrypt_data2(session->internals.selected_key, 0, ++ &ciphertext, premaster_secret.data, ++ premaster_secret.size); ++ /* After this point, any conditional on failure that cause differences ++ * in execution may create a timing or cache access pattern side ++ * channel that can be used as an oracle, so tread carefully */ ++ ++ /* Error handling logic: ++ * In case decryption fails then don't inform the peer. Just use the ++ * random key previously generated. (in order to avoid attack against ++ * pkcs-1 formatting). ++ * ++ * If we get version mismatches no error is returned either. We ++ * proceed normally. This is to defend against the attack described ++ * in the paper "Attacking RSA-based sessions in SSL/TLS" by ++ * Vlastimil Klima, Ondej Pokorny and Tomas Rosa. ++ */ ++ + /* This is here to avoid the version check attack + * discussed above. + */ +- +- premaster_secret.data[0] = _gnutls_get_adv_version_major(session); +- premaster_secret.data[1] = _gnutls_get_adv_version_minor(session); ++ premaster_secret.data[0] = ver_maj; ++ premaster_secret.data[1] = ver_min; + + /* find the key of this username + */ +--- a/lib/gnutls_int.h ++++ b/lib/gnutls_int.h +@@ -974,7 +974,6 @@ struct gnutls_priority_st { + bool _no_etm; + bool _no_ext_master_secret; + bool _allow_key_usage_violation; +- bool _allow_wrong_pms; + bool _dumbfw; + unsigned int _dh_prime_bits; /* old (deprecated) variable */ + +@@ -992,7 +991,6 @@ struct gnutls_priority_st { + (x)->no_etm = 1; \ + (x)->no_ext_master_secret = 1; \ + (x)->allow_key_usage_violation = 1; \ +- (x)->allow_wrong_pms = 1; \ + (x)->dumbfw = 1 + + #define ENABLE_PRIO_COMPAT(x) \ +@@ -1001,7 +999,6 @@ struct gnutls_priority_st { + (x)->_no_etm = 1; \ + (x)->_no_ext_master_secret = 1; \ + (x)->_allow_key_usage_violation = 1; \ +- (x)->_allow_wrong_pms = 1; \ + (x)->_dumbfw = 1 + + /* DH and RSA parameters types. +@@ -1126,7 +1123,6 @@ typedef struct { + bool no_etm; + bool no_ext_master_secret; + bool allow_key_usage_violation; +- bool allow_wrong_pms; + bool dumbfw; + + /* old (deprecated) variable. This is used for both srp_prime_bits +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -690,7 +690,6 @@ gnutls_priority_set(gnutls_session_t ses + COPY_TO_INTERNALS(no_etm); + COPY_TO_INTERNALS(no_ext_master_secret); + COPY_TO_INTERNALS(allow_key_usage_violation); +- COPY_TO_INTERNALS(allow_wrong_pms); + COPY_TO_INTERNALS(dumbfw); + COPY_TO_INTERNALS(dh_prime_bits); + diff --git a/meta/recipes-support/gnutls/gnutls_3.7.4.bb b/meta/recipes-support/gnutls/gnutls_3.7.4.bb index fcd9af05dc..25f730b801 100644 --- a/meta/recipes-support/gnutls/gnutls_3.7.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.7.4.bb @@ -23,6 +23,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://arm_eabi.patch \ file://CVE-2022-2509.patch \ file://CVE-2023-0361.patch \ + file://CVE-2023-5981.patch \ " SRC_URI[sha256sum] = "e6adbebcfbc95867de01060d93c789938cf89cc1d1f6ef9ef661890f6217451f" From patchwork Tue Dec 12 22:40:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 36130 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0EFAC4167B for ; Tue, 12 Dec 2023 22:40:46 +0000 (UTC) Received: from mail-ot1-f41.google.com (mail-ot1-f41.google.com [209.85.210.41]) by mx.groups.io with SMTP id smtpd.web11.9987.1702420837419327286 for ; Tue, 12 Dec 2023 14:40:37 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=DwNSO1dm; spf=softfail (domain: sakoman.com, ip: 209.85.210.41, mailfrom: steve@sakoman.com) Received: by mail-ot1-f41.google.com with SMTP id 46e09a7af769-6d9d0d0e083so4957334a34.2 for ; Tue, 12 Dec 2023 14:40:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1702420836; x=1703025636; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=grF2cvE7YYp2oRWRLciESNqd9x5VgFrkjD5u5pUZu2g=; b=DwNSO1dm84bkra7/oOooXI6lXJo7WjaxyKsTA1+aF8fyb5wUphf3EzocKk7Zp8CneO yQhtwmHCcj3K8VSXG26ED4hVy+WSFOYEvWFb8AfHsmmpvWKKP9dPZhW+OcXmVkVr4/tW LGYNOxhcbWVfgU0nSkOvTlniXty0juP3JE7yRWAcDBT/wFbQD6FR9CWNKLzqjTkjfIbR DNfP4nf/v+wbmq3oeV2HtYV9/+/VNDTlaPwUQdSELihr/dMgeA2U4SmpbpKROp2Ok1pt yO0gxd0hPozm+uhJwDAcE0RySPywfOO6soue1x25b/j62WQm1OcKaVHQ8LFHtQnG0iQv 1Mzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702420836; x=1703025636; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=grF2cvE7YYp2oRWRLciESNqd9x5VgFrkjD5u5pUZu2g=; b=N78h2HUVN7NGN+yuwl6UtCwgpjeBsGi3E2zlnHCuIUoe+cPRl4Sg1IH5yhAZGAwcjM 2Hru3dGcn0e9iGWdZcvxlVZ85thZ4EYc39v0u8yGvO5hWWdvJSSv7bgGpZPB4rYuv47j mKE9xMX3i8ZK9QlzUCR7Q2kB+ZpXl1acBcGqWpTBZ59wrJiuwwIijAruA7LYUPpJGfZs Yp0RiAZbTvwMeo7jETI/7eDwsmcizdhwH2SRZEuEnyfyf/d8wEhTLxpNKZfAuW/2G+qd b6bdQCiz7eEaeDnkqKnT6my/J0qqOYq5HzEDXrkfW2Vh7Mc72TCY6FM4R9dLtBmOZlVm Y8Hg== X-Gm-Message-State: AOJu0YyFL3myNlbm60VLYDtmIcj9vvYDH1yiOnF5TJrjaoklq8rdLSqr tdEtqVHyN6fPzyRwB7fBAefPqsU2kzcZCbXAxr4= X-Google-Smtp-Source: AGHT+IENgf+Xb8AZcuOlb7AXUcSl0xv6YupJWtXAfa1o0hcxZSCxuZH/8ezKwBZvf/Uwf7g8qp5PAQ== X-Received: by 2002:a05:6808:14d5:b0:3b9:e3d7:1271 with SMTP id f21-20020a05680814d500b003b9e3d71271mr9395930oiw.9.1702420836473; Tue, 12 Dec 2023 14:40:36 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-234-108-41.hawaiiantel.net. [72.234.108.41]) by smtp.gmail.com with ESMTPSA id g25-20020aa78759000000b006d0951e74cbsm3847974pfo.178.2023.12.12.14.40.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 14:40:36 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 4/5] gstreamer1.0-plugins-base: enable glx/opengl support Date: Tue, 12 Dec 2023 12:40:19 -1000 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 12 Dec 2023 22:40:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192250 From: Alexander Kanavin This is required by latest webkit when built with x11 support. (From OE-Core rev: 024edebf6f722ae4d05411be348730d9eeb3bd7c) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie Signed-off-by: Claus Stovgaard Signed-off-by: Steve Sakoman --- .../gstreamer/gstreamer1.0-plugins-base_1.20.7.bb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb index 8822c6a905..8dfa70aea3 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb @@ -21,7 +21,8 @@ inherit gobject-introspection # opengl packageconfig factored out to make it easy for distros # and BSP layers to choose OpenGL APIs/platforms/window systems -PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl', '', d)}" +PACKAGECONFIG_X11 = "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'opengl glx', '', d)}" +PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl ${PACKAGECONFIG_X11}', '', d)}" PACKAGECONFIG ??= " \ ${GSTREAMER_ORC} \ @@ -32,7 +33,7 @@ PACKAGECONFIG ??= " \ " OPENGL_APIS = 'opengl gles2' -OPENGL_PLATFORMS = 'egl' +OPENGL_PLATFORMS = 'egl glx' X11DEPENDS = "virtual/libx11 libsm libxrender libxv" X11ENABLEOPTS = "-Dx11=enabled -Dxvideo=enabled -Dxshm=enabled" @@ -61,6 +62,7 @@ PACKAGECONFIG[gles2] = ",,virtual/libgles2" # OpenGL platform packageconfigs PACKAGECONFIG[egl] = ",,virtual/egl" +PACKAGECONFIG[glx] = ",,virtual/libgl" # OpenGL window systems (except for X11) PACKAGECONFIG[gbm] = ",,virtual/libgbm libgudev libdrm" From patchwork Tue Dec 12 22:40:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 36129 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0ECAC4332F for ; Tue, 12 Dec 2023 22:40:46 +0000 (UTC) Received: from mail-ot1-f50.google.com (mail-ot1-f50.google.com [209.85.210.50]) by mx.groups.io with SMTP id smtpd.web11.9988.1702420839581131274 for ; Tue, 12 Dec 2023 14:40:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=u4xFzDHr; spf=softfail (domain: sakoman.com, ip: 209.85.210.50, mailfrom: steve@sakoman.com) Received: by mail-ot1-f50.google.com with SMTP id 46e09a7af769-6d9f9fbfd11so2865368a34.2 for ; Tue, 12 Dec 2023 14:40:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1702420838; x=1703025638; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=N2aAaiZ85/tbtR505dDO+52SRxmv3lq+6HzNhrs9t7w=; b=u4xFzDHr7kStXSE1YvpEh6+pkVpFRM1ScH11MhXwxMma4kMbuqOI/J3tmJKKEb+13p O9ZVX+JNKkgkzFKBJsywjRF1Lk8jrNz8pqZXiR6WEjPVFfg6AXN7qIQKkAMGRB+WDffc Hr8jWyec0sGz4jcozKJIrIMyYQVyZZwffpFhtAnCA2c9I7IP2+gs2V5mzz6D+WOnQ+Ov XRBd3plgvqegBiqiy4LcW1FrTqRntfAoBsH2qcT7d1XhiYniqpM9BWLl/rdkEJuXN346 76xILbHRQG3lhqtMDeH/1ljmA16YYzSKhCydbiZBgN1Q/nXvOmXV7nnlPlD0MNYUvDwV C+jQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702420838; x=1703025638; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=N2aAaiZ85/tbtR505dDO+52SRxmv3lq+6HzNhrs9t7w=; b=QAzAU7C+uuXusahMpMMlDxT49A8B+9u/DtCiovyCWP0u/uKv8n14ngokGo9XbT5oRi jdAmjViWI6r3Z43kOwYWkEbr0WyL8KkpcjLxJpxFENe3n9IMjrYbC4F1RWglEUnQq0Fm XGnFTweFYJBJMHrvu/4c3g/pfo47m5cs/yoZbUfGgk4jTLn4j5a+E80OtQlr86PYFDFg 4LvprUGzASa8F8iYmceQbUWGjvntP7xbIXdFILdBLRPR6bMnEHwQoGQQ4LfNsdt7Grh6 iLAPhhoFtxgOAZxs6RXikylptdDVCRGB+KKrFEqOgI+U9j081uZ6MwiXb7C5HsOeEl51 2gqA== X-Gm-Message-State: AOJu0YwKhHtAWR4ZMW4HmZx/9NprhnRMoAb82p/xbk6yb3BI+Gt7CKbq MJu5tWsoUZy19VDiQiDaULVf7UQxUCJQfvD7T68= X-Google-Smtp-Source: AGHT+IHiF9XMt+0yfwrDrJLwcVALEpI2hl8GU23Is7NX8l8GTP3uHnZtoe+somnlwIpvCw7YtVpa+Q== X-Received: by 2002:a05:6830:16c5:b0:6cd:a989:c7ea with SMTP id l5-20020a05683016c500b006cda989c7eamr6320843otr.16.1702420838182; Tue, 12 Dec 2023 14:40:38 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-234-108-41.hawaiiantel.net. [72.234.108.41]) by smtp.gmail.com with ESMTPSA id g25-20020aa78759000000b006d0951e74cbsm3847974pfo.178.2023.12.12.14.40.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 14:40:37 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 5/5] openssh: drop sudo from ptest dependencies Date: Tue, 12 Dec 2023 12:40:20 -1000 Message-Id: <96888cdac83ecc328ee4039bd1dd3f29b775cb40.1702420654.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 12 Dec 2023 22:40:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192251 From: Mikko Rapeli The tests don't actually need sudo on core-image-ptest-openssh. Based on logs seen in https://bugzilla.yoctoproject.org/show_bug.cgi?id=15178 it seems that socket errors from sudo are creeping into stderr which are failing the banner ptest from openssh. Removing sudo should help removing the stderr messages and possibly cure the banner test failures. (From OE-Core rev: 47e754f483b674b207bfddcc8d4c5d9a3008e102) Signed-off-by: Mikko Rapeli Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman --- meta/recipes-connectivity/openssh/openssh/run-ptest | 2 +- meta/recipes-connectivity/openssh/openssh_8.9p1.bb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-connectivity/openssh/openssh/run-ptest b/meta/recipes-connectivity/openssh/openssh/run-ptest index 8a9b770d59..9a406e9b65 100755 --- a/meta/recipes-connectivity/openssh/openssh/run-ptest +++ b/meta/recipes-connectivity/openssh/openssh/run-ptest @@ -5,7 +5,7 @@ export SKIP_UNIT=1 cd regress sed -i "/\t\tagent-ptrace /d" Makefile -make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="sudo" tests \ +make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="" tests \ | sed -u -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g' SSHAGENT=`which ssh-agent` diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb index da7ab7716c..32761b8bb8 100644 --- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb @@ -170,7 +170,7 @@ RDEPENDS:${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pa # conflict with each other RDEPENDS:${PN}-dev = "" # gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies -RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils" +RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed coreutils" RPROVIDES:${PN}-ssh = "ssh" RPROVIDES:${PN}-sshd = "sshd"