| Message ID | 20251115123843.708911-1-skandigraun@gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [meta-oe,1/4] yasm: add alternative CVE_PRODUCT | expand |
Please ignore this - made a typo in the CVE id at multiple places - it is 29579, not 59579. Will send a new version. On 11/15/25 13:38, Gyorgy Sarvari via lists.openembedded.org wrote: > Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579 > > The patch was taken from Debian: > https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/ > > Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> > --- > .../yasm/yasm/CVE-2023-59579.patch | 39 +++++++++++++++++++ > meta-oe/recipes-devtools/yasm/yasm_git.bb | 3 +- > 2 files changed, 41 insertions(+), 1 deletion(-) > create mode 100644 meta-oe/recipes-devtools/yasm/yasm/CVE-2023-59579.patch > > diff --git a/meta-oe/recipes-devtools/yasm/yasm/CVE-2023-59579.patch b/meta-oe/recipes-devtools/yasm/yasm/CVE-2023-59579.patch > new file mode 100644 > index 0000000000..564b27f5e5 > --- /dev/null > +++ b/meta-oe/recipes-devtools/yasm/yasm/CVE-2023-59579.patch > @@ -0,0 +1,39 @@ > +From 81c1b7b0a28f052eaadddcb010944bf67e6ae257 Mon Sep 17 00:00:00 2001 > +From: Gyorgy Sarvari <skandigraun@gmail.com> > +Date: Sat, 15 Nov 2025 13:24:21 +0100 > +Subject: [PATCH] Make sure CPU feature parsing use large enough string buffer. > + Fixes CVE-2023-29579. > + > +Author: Petter Reinholdtsen <pere@debian.org> > +Bug: https://github.com/yasm/yasm/issues/214 > +Bug-Debian: https://bugs.debian.org/1035951 > +Forwarded: https://github.com/yasm/yasm/issues/214 > +Last-Update: 2025-04-30 > + > +This patch is taken from Debian: > +https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/ > + > +CVE: CVE-2023-59579 > +Upstream-Status: Submitted [https://github.com/yasm/yasm/issues/214] > + > +Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> > +--- > + modules/arch/x86/x86arch.c | 5 +++-- > + 1 file changed, 3 insertions(+), 2 deletions(-) > + > +diff --git a/modules/arch/x86/x86arch.c b/modules/arch/x86/x86arch.c > +index bac11774..58327958 100644 > +--- a/modules/arch/x86/x86arch.c > ++++ b/modules/arch/x86/x86arch.c > +@@ -165,8 +165,9 @@ x86_dir_cpu(yasm_object *object, yasm_valparamhead *valparams, > + yasm_error_set(YASM_ERROR_SYNTAX, > + N_("invalid argument to [%s]"), "CPU"); > + else { > +- char strcpu[16]; > +- sprintf(strcpu, "%lu", yasm_intnum_get_uint(intcpu)); > ++ char strcpu[21]; /* 21 = ceil(log10(LONG_MAX)+1) */ > ++ assert(8*sizeof(unsigned long) <= 64); > ++ snprintf(strcpu, sizeof(strcpu), "%lu", yasm_intnum_get_uint(intcpu)); > + yasm_x86__parse_cpu(arch_x86, strcpu, strlen(strcpu)); > + } > + } else > diff --git a/meta-oe/recipes-devtools/yasm/yasm_git.bb b/meta-oe/recipes-devtools/yasm/yasm_git.bb > index abaeef4db3..f4f84a21f7 100644 > --- a/meta-oe/recipes-devtools/yasm/yasm_git.bb > +++ b/meta-oe/recipes-devtools/yasm/yasm_git.bb > @@ -14,7 +14,8 @@ SRC_URI = "git://github.com/yasm/yasm.git;branch=master;protocol=https \ > file://0001-yasm-Set-build-date-to-SOURCE_DATE_EPOCH.patch \ > file://0002-yasm-Use-BUILD_DATE-for-reproducibility.patch \ > file://0001-bitvect-fix-build-with-gcc-15.patch \ > -" > + file://CVE-2023-59579.patch \ > + " > > > inherit autotools gettext python3native > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#121723): https://lists.openembedded.org/g/openembedded-devel/message/121723 > Mute This Topic: https://lists.openembedded.org/mt/116306636/6084445 > Group Owner: openembedded-devel+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [skandigraun@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta-oe/recipes-devtools/yasm/yasm_git.bb b/meta-oe/recipes-devtools/yasm/yasm_git.bb index 68895a1697..abaeef4db3 100644 --- a/meta-oe/recipes-devtools/yasm/yasm_git.bb +++ b/meta-oe/recipes-devtools/yasm/yasm_git.bb @@ -33,3 +33,5 @@ do_configure:prepend() { CVE_STATUS_GROUPS += "CVE_STATUS_HASH_UPDATE" CVE_STATUS_HASH_UPDATE = "CVE-2021-33454 CVE-2023-31975 CVE-2023-37732" CVE_STATUS_HASH_UPDATE[status] = "fixed-version: patched in current git hash" + +CVE_PRODUCT += "tortall:yasm yasm_project:yasm"
There are multiple vendors for yasm: $ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';" tortall|yasm yasm_project|yasm Both products refer to the same application Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> --- meta-oe/recipes-devtools/yasm/yasm_git.bb | 2 ++ 1 file changed, 2 insertions(+)