diff mbox series

[dunfell,v2] gawk: Backport CVE-2023-4156 fix

Message ID 20231009191935.202467-1-marex@denx.de
State Accepted, archived
Delegated to: Steve Sakoman
Headers show
Series [dunfell,v2] gawk: Backport CVE-2023-4156 fix | expand

Commit Message

Marek Vasut Oct. 9, 2023, 7:19 p.m. UTC 
Pick fix for CVE-2023-4156 from ubuntu 20.04

A heap out-of-bounds read flaw was found in builtin.c in the gawk
package. This issue may lead to a crash and could be used to read
sensitive information.

https://nvd.nist.gov/vuln/detail/CVE-2023-4156

Upstream commit:
https://git.savannah.gnu.org/cgit/gawk.git/commit/?id=e709eb829448ce040087a3fc5481db6bfcaae212

https://packages.ubuntu.com/source/focal/gawk
gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f

Signed-off-by: Marek Vasut <marex@denx.de>
---
V2: Add Upstream-Status for
    https://git.savannah.gnu.org/cgit/gawk.git/commit/?id=e709eb829448ce040087a3fc5481db6bfcaae212
---
 .../gawk/gawk/CVE-2023-4156.patch             | 27 +++++++++++++++++++
 meta/recipes-extended/gawk/gawk_5.0.1.bb      |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch

Comments

Steve Sakoman Oct. 9, 2023, 9:15 p.m. UTC | #1 
Sorry I didn't catch this earlier, but I stopped reviewing after
noticing the Signed-off-by omission.

There was already a patch submitted for this CVE:

https://lists.openembedded.org/g/openembedded-core/message/188624

Steve

On Mon, Oct 9, 2023 at 9:19 AM Marek Vasut <marex@denx.de> wrote:
>
> Pick fix for CVE-2023-4156 from ubuntu 20.04
>
> A heap out-of-bounds read flaw was found in builtin.c in the gawk
> package. This issue may lead to a crash and could be used to read
> sensitive information.
>
> https://nvd.nist.gov/vuln/detail/CVE-2023-4156
>
> Upstream commit:
> https://git.savannah.gnu.org/cgit/gawk.git/commit/?id=e709eb829448ce040087a3fc5481db6bfcaae212
>
> https://packages.ubuntu.com/source/focal/gawk
> gawk_5.0.1+dfsg-1ubuntu0.1.debian.tar.xz / 12.9 kB / 12d878acc04cd6328b793455547c870f
>
> Signed-off-by: Marek Vasut <marex@denx.de>
> ---
> V2: Add Upstream-Status for
>     https://git.savannah.gnu.org/cgit/gawk.git/commit/?id=e709eb829448ce040087a3fc5481db6bfcaae212
> ---
>  .../gawk/gawk/CVE-2023-4156.patch             | 27 +++++++++++++++++++
>  meta/recipes-extended/gawk/gawk_5.0.1.bb      |  1 +
>  2 files changed, 28 insertions(+)
>  create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
>
> diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
> new file mode 100644
> index 0000000000..8c88b93795
> --- /dev/null
> +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
> @@ -0,0 +1,27 @@
> +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
> +From: "Arnold D. Robbins" <arnold@skeeve.com>
> +Date: Wed, 3 Aug 2022 13:00:54 +0300
> +Subject: [PATCH] Smal bug fix in builtin.c.
> +
> +CVE: CVE-2023-4156
> +Upstream-Status: Backport [e709eb829448ce040087a3fc5481db6bfcaae212]
> +Signed-off-by: Marek Vasut <marex@denx.de>
> +---
> + ChangeLog | 6 ++++++
> + builtin.c | 5 ++++-
> + 2 files changed, 10 insertions(+), 1 deletion(-)
> +
> +--- gawk-5.1.0.orig/builtin.c
> ++++ gawk-5.1.0/builtin.c
> +@@ -957,7 +957,10 @@ check_pos:
> +                                       s1++;
> +                                       n0--;
> +                               }
> +-                              if (val >= num_args) {
> ++                              // val could be less than zero if someone provides a field width
> ++                              // so large that it causes integer overflow. Mainly fuzzers do this,
> ++                              // but let's try to be good anyway.
> ++                              if (val < 0 || val >= num_args) {
> +                                       toofew = true;
> +                                       break;
> +                               }
> diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb
> index 1b29ec3113..7ca4cb77e4 100644
> --- a/meta/recipes-extended/gawk/gawk_5.0.1.bb
> +++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb
> @@ -17,6 +17,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr"
>
>  SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
>             file://remove-sensitive-tests.patch \
> +           file://CVE-2023-4156.patch \
>             file://run-ptest \
>  "
>
> --
> 2.40.1
>
Marek Vasut Oct. 9, 2023, 9:37 p.m. UTC | #2 
On 10/9/23 23:15, Steve Sakoman wrote:
> Sorry I didn't catch this earlier, but I stopped reviewing after
> noticing the Signed-off-by omission.

What Signed-off-by omission ?

> There was already a patch submitted for this CVE:
> 
> https://lists.openembedded.org/g/openembedded-core/message/188624

OK
Steve Sakoman Oct. 9, 2023, 10:19 p.m. UTC | #3 
On Mon, Oct 9, 2023, 11:37 AM Marek Vasut <marex@denx.de> wrote:

> On 10/9/23 23:15, Steve Sakoman wrote:
> > Sorry I didn't catch this earlier, but I stopped reviewing after
> > noticing the Signed-off-by omission.
>
> What Signed-off-by omission ?
>

Sorry, I meant the Upstream-Status omission in the first version of this
patch!

It's been a long Monday :-(

Steve

>
> > There was already a patch submitted for this CVE:
> >
> > https://lists.openembedded.org/g/openembedded-core/message/188624
>
> OK
>
diff mbox series

Patch

diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
new file mode 100644
index 0000000000..8c88b93795
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
@@ -0,0 +1,27 @@ 
+From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Wed, 3 Aug 2022 13:00:54 +0300
+Subject: [PATCH] Smal bug fix in builtin.c.
+
+CVE: CVE-2023-4156
+Upstream-Status: Backport [e709eb829448ce040087a3fc5481db6bfcaae212]
+Signed-off-by: Marek Vasut <marex@denx.de>
+---
+ ChangeLog | 6 ++++++
+ builtin.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- gawk-5.1.0.orig/builtin.c
++++ gawk-5.1.0/builtin.c
+@@ -957,7 +957,10 @@ check_pos:
+ 					s1++;
+ 					n0--;
+ 				}
+-				if (val >= num_args) {
++				// val could be less than zero if someone provides a field width
++				// so large that it causes integer overflow. Mainly fuzzers do this,
++				// but let's try to be good anyway.
++				if (val < 0 || val >= num_args) {
+ 					toofew = true;
+ 					break;
+ 				}
diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb b/meta/recipes-extended/gawk/gawk_5.0.1.bb
index 1b29ec3113..7ca4cb77e4 100644
--- a/meta/recipes-extended/gawk/gawk_5.0.1.bb
+++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb
@@ -17,6 +17,7 @@  PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr"
 
 SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
            file://remove-sensitive-tests.patch \
+           file://CVE-2023-4156.patch \
            file://run-ptest \
 "