From patchwork Fri Jan 31 14:15:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 56367 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4682C0218F for ; Fri, 31 Jan 2025 14:15:41 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.web11.19653.1738332939945792931 for ; Fri, 31 Jan 2025 06:15:40 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=xMNHAy1v; spf=softfail (domain: sakoman.com, ip: 209.85.214.176, mailfrom: steve@sakoman.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-21644aca3a0so47520185ad.3 for ; Fri, 31 Jan 2025 06:15:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1738332939; x=1738937739; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=BWa1llRsXApDx/6fEZl+QIddsRVU0f1IrjF8gaafwg8=; b=xMNHAy1vSQkC4VhasqLohsWBpAEZ+107tBqMVuCXBUN3YzjxxycpaJ+qjtQz+Iq496 Xho2KM0adn6NX4ii0A8VaSZ9INlxtTE2f6QQcctAJzK7UzGtp3/R/0L+4z2Egk+PqDDQ 0Rm5zyAPk8VoH16N3iFx9l1zSSC9rJeuANQv5rScpBcT66CPNHSLVdACOXK+3pG85te7 6go4hMK2vbxAz7wo6A1LqJovb61X32ghUhp0L1w37rV9ZfUHDyoF8Rtmg+FPvq4aSpRN A6ppJmdhwV5U3uY+Ms95KY+QqjAdQ634gZlUylNjkaPU9ZWKFvFpBSelNZE3352YBwTG PS5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738332939; x=1738937739; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BWa1llRsXApDx/6fEZl+QIddsRVU0f1IrjF8gaafwg8=; b=WId2aItzg2r6/guGCNgi6PZL7TLm6A0GdUtQsyIBWwvzXSkev0zAQ1UIxkhvFs2Kct IARo/zKWGts84vEc1TUYPz2vfUOdCFQxrKDDJapIDotfgL0JW4JpvcQoGZg1o1iMILaf RbY2oisRgDAVhKG44Oj6bXWIWyBQraUA2otl4ahg2CKRNIkR40Km+wmDVJh/R0KAuFiN 0DG6Lz4cKXH8RtQSldXdcUxkFFhs1f2JysrNSiwdfaadw4Jj1TXR0XktZZ619KniOcXP /ykGMOIuhdbQ7GCqr1LJJ0FYcPE0+Y+0iYi+Nur+cJVfCKLhdTq9InB3mTEKJYc1P+/v bFlw== X-Gm-Message-State: AOJu0YxEsh4LyhenBLxpzoscmiXdJxp3uphwCv5ELRt+0HciDgdKuHSn XP2p1tH1spW99WKew5V6F+1B6/ce5P/149TshJSC33j6b9HN/CdWnS4qHnByEs7Kn+oLrjaYKtg qCVo= X-Gm-Gg: ASbGncskQ/dNavv5GkFiLAeWa78CQPEP+jkx/nYYvxaJBBDJmI1p9UUCjxAbtkaAA2v 3Z63hRU7pVcRK4Xc1FrvoAHsk0kMPek053W5SnFbmg3KRcSe2u2DJCMmGMtk8XHk6/cWv1iFa+d RQqzhzygnwQnuR+uihd71eY7h2tHTFWfKh8VCWk4aS7Ki/8+5tIjjjOLWo6AapIwJoqgG+BQMBC 8Z8YHRA+1/mGJy+c3xOMyxhpYb5JUMZnufKpwrMv9YZ7b2ahA2Go/3sCOSOoFwMb9qPMortMRn/ 9wYO X-Google-Smtp-Source: AGHT+IG7Zn86Gxln3E+RSHpV4PcGsXbXzlVkB6JIribqiDhnoBQx0oZnrkQT6usqh87IffPh32qYcg== X-Received: by 2002:a05:6a20:3954:b0:1e1:a434:2964 with SMTP id adf61e73a8af0-1ed7a5c41ecmr20367757637.2.1738332939047; Fri, 31 Jan 2025 06:15:39 -0800 (PST) Received: from hexa.. ([98.142.47.158]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-72fe6a1a958sm3412644b3a.172.2025.01.31.06.15.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jan 2025 06:15:38 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 1/4] openssl: patch CVE-2024-13176 Date: Fri, 31 Jan 2025 06:15:27 -0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jan 2025 14:15:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/210483 From: Peter Marko Picked [1] per link in [2]. [1] https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-13176 Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- .../openssl/openssl/CVE-2024-13176.patch | 125 ++++++++++++++++++ .../openssl/openssl_3.0.15.bb | 1 + 2 files changed, 126 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch new file mode 100644 index 0000000000..0076003db1 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch @@ -0,0 +1,125 @@ +From 07272b05b04836a762b4baa874958af51d513844 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Wed, 15 Jan 2025 18:27:02 +0100 +Subject: [PATCH] Fix timing side-channel in ECDSA signature computation + +There is a timing signal of around 300 nanoseconds when the top word of +the inverted ECDSA nonce value is zero. This can happen with significant +probability only for some of the supported elliptic curves. In particular +the NIST P-521 curve is affected. To be able to measure this leak, the +attacker process must either be located in the same physical computer or +must have a very fast network connection with low latency. + +Attacks on ECDSA nonce are also known as Minerva attack. + +Fixes CVE-2024-13176 + +Reviewed-by: Tim Hudson +Reviewed-by: Neil Horman +Reviewed-by: Paul Dale +(Merged from https://github.com/openssl/openssl/pull/26429) + +(cherry picked from commit 63c40a66c5dc287485705d06122d3a6e74a6a203) + +CVE: CVE-2024-13176 +Upstream-Status: Backport [https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844] +Signed-off-by: Peter Marko +--- + crypto/bn/bn_exp.c | 21 +++++++++++++++------ + crypto/ec/ec_lib.c | 7 ++++--- + include/crypto/bn.h | 3 +++ + 3 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c +index 598a592ca1397..d84c7de18a6b6 100644 +--- a/crypto/bn/bn_exp.c ++++ b/crypto/bn/bn_exp.c +@@ -606,7 +606,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, + * out by Colin Percival, + * http://www.daemonology.net/hyperthreading-considered-harmful/) + */ +-int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, + BN_MONT_CTX *in_mont) + { +@@ -623,10 +623,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + unsigned int t4 = 0; + #endif + +- bn_check_top(a); +- bn_check_top(p); +- bn_check_top(m); +- + if (!BN_is_odd(m)) { + ERR_raise(ERR_LIB_BN, BN_R_CALLED_WITH_EVEN_MODULUS); + return 0; +@@ -1146,7 +1142,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + goto err; + } else + #endif +- if (!BN_from_montgomery(rr, &tmp, mont, ctx)) ++ if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx)) + goto err; + ret = 1; + err: +@@ -1160,6 +1156,19 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + return ret; + } + ++int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++ const BIGNUM *m, BN_CTX *ctx, ++ BN_MONT_CTX *in_mont) ++{ ++ bn_check_top(a); ++ bn_check_top(p); ++ bn_check_top(m); ++ if (!bn_mod_exp_mont_fixed_top(rr, a, p, m, ctx, in_mont)) ++ return 0; ++ bn_correct_top(rr); ++ return 1; ++} ++ + int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont) + { +diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c +index b1696d93bd6dd..1f0bf1ec795fa 100644 +--- a/crypto/ec/ec_lib.c ++++ b/crypto/ec/ec_lib.c +@@ -20,6 +20,7 @@ + #include + #include + #include "crypto/ec.h" ++#include "crypto/bn.h" + #include "internal/nelem.h" + #include "ec_local.h" + +@@ -1262,10 +1263,10 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r, + if (!BN_sub(e, group->order, e)) + goto err; + /*- +- * Exponent e is public. +- * No need for scatter-gather or BN_FLG_CONSTTIME. ++ * Although the exponent is public we want the result to be ++ * fixed top. + */ +- if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data)) ++ if (!bn_mod_exp_mont_fixed_top(r, x, e, group->order, ctx, group->mont_data)) + goto err; + + ret = 1; +diff --git a/include/crypto/bn.h b/include/crypto/bn.h +index c5f328156d3a9..59a629b9f6288 100644 +--- a/include/crypto/bn.h ++++ b/include/crypto/bn.h +@@ -73,6 +73,9 @@ int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words); + */ + int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, + BN_MONT_CTX *mont, BN_CTX *ctx); ++int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++ const BIGNUM *m, BN_CTX *ctx, ++ BN_MONT_CTX *in_mont); + int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, + BN_CTX *ctx); + int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, diff --git a/meta/recipes-connectivity/openssl/openssl_3.0.15.bb b/meta/recipes-connectivity/openssl/openssl_3.0.15.bb index 5f7e7c0000..295f05729f 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.0.15.bb +++ b/meta/recipes-connectivity/openssl/openssl_3.0.15.bb @@ -13,6 +13,7 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op file://afalg.patch \ file://0001-Configure-do-not-tweak-mips-cflags.patch \ file://CVE-2024-9143.patch \ + file://CVE-2024-13176.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Jan 31 14:15:28 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 56369 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DDB5C02192 for ; Fri, 31 Jan 2025 14:15:51 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.web11.19654.1738332941489366425 for ; Fri, 31 Jan 2025 06:15:41 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=iZUTOZ0h; spf=softfail (domain: sakoman.com, ip: 209.85.214.173, mailfrom: steve@sakoman.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-21c2f1b610dso46501325ad.0 for ; Fri, 31 Jan 2025 06:15:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1738332941; x=1738937741; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=941Sk92cd9aks85ZHn+IEpAE1zFMbO+RpeqS4DCmU2k=; b=iZUTOZ0hQJBNzxEUhgF/r7sJiIhSFplzr+6gG907h3eNgUtIOC+jPYm6wWUIDBQA/X UdK/7CPmkd7sTo/j3V+auDbrrvzXWt8cK7H8zSk42fTSPs80HAFS9aaK68bpaBz3tYd/ /mkG6U6bd1dZSMHQjY6hvQiLC+dsCwtIghLlqcGC54IpTvHVu800/dD1IjCzhB4RQwdI NGcD0BjiJ/EYMRkjMFKgjfXwjhQuHSGrruxzQx3565kjFo1/S2GcMQZ+Zx0SiOweIkiC HDYm85pBMb5yK/AWLDkYDPSBFHId6YqTJauPZWtnde8JO3tqXmIJdho8GdFXKeNDYNvw Gf6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738332941; x=1738937741; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=941Sk92cd9aks85ZHn+IEpAE1zFMbO+RpeqS4DCmU2k=; b=FGwiSvlq0DQ5SBQyjOZBz7SH7ZHVrWIPO4eXFDRbA/UzGXVqOgDPn6mGZI3rlKgtZc YLX0FnAU737Tz/jBfv92HPN5b+Htvi1pWgygkUR0GsPEPSyGhzvC/diUP8TK8JyOPJia vGiBdNYvU6tQfdybnoS9A8PcwklIgE4tKdjpMFd0xYvRKSBDI+hj5MfZh/44K+4mnoVB gkOOcp9RRuBczlkS3BAUV48VbYo4uBVy/IDpNgjbNcRYnbT81gB8phYlld3FyCmRGkEb AJmB9t3gVty/t1d6H+CS0zqgUOqFjZjKbw22VwaX8BVGsXvu0Uzuymf4qxUdnV8jQDIO hr1Q== X-Gm-Message-State: AOJu0YzsT75k9oI+dEZMBgyfmAH0bTh3WjjnPFSQitzBrs3ECtbBfyIH CYrP0hIoVcyYyBoUyOctQgD1Do2AJkWPbQp3+P7Vu+E7W93P9bWB3L4aAXXl7CRUfs5/CvFaZpA Og9k= X-Gm-Gg: ASbGncvgIjP4tkvZHuYHxu40xkYSusNjVXT+Yk/ZBGp2mTEO9P/4Rqsfd7RG2Z9VhRS 5to71yjfATNsySYqQWEpSv8VhpjIDoPIGc3YALDKLo+56pKJuiduMw6a30y4o8u+TvP30xoYJ2v YsYNmhgK2hbyn/UpMN/RUkZKGVZA9Qr4q61C71Jw0E7IM/Jq40Cl026uIjka//1DQ0PGY2BZdjD XZanAiENzBp82srVkiyMk6oh7KHW+GPXwL/w5rkQPuBG9Qd2R0VRUAZPY6qbxMyTGmZRCg6YdyB qyGg X-Google-Smtp-Source: AGHT+IFC7a/RELRMGOT61mHSSrOmJhDSfGooG41UhVepERHzkWbnq3WupbgJclT7S2NXqgL1lRmwpg== X-Received: by 2002:a05:6a00:4f83:b0:71e:13ac:d835 with SMTP id d2e1a72fcca58-72fd0c14abbmr16290079b3a.11.1738332940586; Fri, 31 Jan 2025 06:15:40 -0800 (PST) Received: from hexa.. ([98.142.47.158]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-72fe6a1a958sm3412644b3a.172.2025.01.31.06.15.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jan 2025 06:15:40 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 2/4] binutils: internal gdb: Fix CVE-2024-53589 Date: Fri, 31 Jan 2025 06:15:28 -0800 Message-ID: <2d6df18f4a694d6499b337bbbab10ba8bb6e3fe4.1738332771.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jan 2025 14:15:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/210484 From: Yash Shinde CVE: CVE-2024-53589 Signed-off-by: Yash Shinde Signed-off-by: Steve Sakoman --- .../binutils/binutils-2.38.inc | 1 + .../binutils/0037-CVE-2024-53589.patch | 92 +++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc index 032e67a213..e577a10cb8 100644 --- a/meta/recipes-devtools/binutils/binutils-2.38.inc +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc @@ -71,5 +71,6 @@ SRC_URI = "\ file://0034-CVE-2022-48064.patch \ file://0035-CVE-2023-39129.patch \ file://0036-CVE-2023-39130.patch \ + file://0037-CVE-2024-53589.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch b/meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch new file mode 100644 index 0000000000..380112a3ba --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch @@ -0,0 +1,92 @@ +Author: Alan Modra +Date: Mon Nov 11 10:24:09 2024 +1030 + + Re: tekhex object file output fixes + + Commit 8b5a212495 supported *ABS* symbols by allowing "section" to be + bfd_abs_section, but bfd_abs_section needs to be treated specially. + In particular, bfd_get_next_section_by_name (.., bfd_abs_section_ptr) + is invalid. + + PR 32347 + * tekhex.c (first_phase): Guard against modification of + _bfd_std_section[] entries. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] +CVE: CVE-2024-53589 + +Signed-off-by: Yash Shinde + +diff --git a/bfd/tekhex.c b/bfd/tekhex.c +index aea2ebb23df..b305c1f96f1 100644 +--- a/bfd/tekhex.c ++++ b/bfd/tekhex.c +@@ -361,6 +361,7 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + asection *section, *alt_section; + unsigned int len; ++ bfd_vma addr; + bfd_vma val; + char sym[17]; /* A symbol can only be 16chars long. */ + +@@ -368,20 +369,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '6': + /* Data record - read it and store it. */ +- { +- bfd_vma addr; +- +- if (!getvalue (&src, &addr, src_end)) +- return false; +- +- while (*src && src < src_end - 1) +- { +- insert_byte (abfd, HEX (src), addr); +- src += 2; +- addr++; +- } +- return true; +- } ++ if (!getvalue (&src, &addr, src_end)) ++ return false; ++ ++ while (*src && src < src_end - 1) ++ { ++ insert_byte (abfd, HEX (src), addr); ++ src += 2; ++ addr++; ++ } ++ return true; + + case '3': + /* Symbol record, read the segment. */ +@@ -406,13 +403,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '1': /* Section range. */ + src++; +- if (!getvalue (&src, §ion->vma, src_end)) ++ if (!getvalue (&src, &addr, src_end)) + return false; + if (!getvalue (&src, &val, src_end)) + return false; +- if (val < section->vma) +- val = section->vma; +- section->size = val - section->vma; ++ if (bfd_is_const_section (section)) ++ break; ++ section->vma = addr; ++ if (val < addr) ++ val = addr; ++ section->size = val - addr; + /* PR 17512: file: objdump-s-endless-loop.tekhex. + Check for overlarge section sizes. */ + if (section->size & 0x80000000) +@@ -455,6 +455,8 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + new_symbol->symbol.flags = BSF_LOCAL; + if (stype == '2' || stype == '6') + new_symbol->symbol.section = bfd_abs_section_ptr; ++ else if (bfd_is_const_section (section)) ++ ; + else if (stype == '3' || stype == '7') + { + if ((section->flags & SEC_DATA) == 0) From patchwork Fri Jan 31 14:15:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 56368 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4472C3DA4A for ; Fri, 31 Jan 2025 14:15:51 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web10.20049.1738332942830634005 for ; Fri, 31 Jan 2025 06:15:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=H/pKcmu3; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2164b1f05caso36199225ad.3 for ; Fri, 31 Jan 2025 06:15:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1738332942; x=1738937742; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=PB0aLuZTAig0yGpMIBSrxjLLyxu/a/ni7/QPJGwWvlQ=; b=H/pKcmu3F1NXb7Ks0Mc9BHpoapwhNiEqUxeNmF9tc7mPKW5Cx5nPXkTA19zPLVN4wE srM5lTbSn6IbHmbnYzt49l8+XTv4HSWaqBVucXg/IbBMFGWI12RG2i4CcO95a+bZ1wKT mu2mOvyfztG2CH8NoJUeyGgN3ZoEnkuhO40rsjGAG3hk6lCbg3vQQME1c996mnqT65iV 2YBLjxgHfn0uNcVk9RllH6LNrAK5F9KyrYG1ANrew61i1acldGONoKt4/WJhOPWmcuPT xjktfdiquHWJsdvBpf6h/HJpop/wI+MV8oco70yn3KAWpwA0rVDHZgv6C68E7L8BFOKt P1Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738332942; x=1738937742; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=PB0aLuZTAig0yGpMIBSrxjLLyxu/a/ni7/QPJGwWvlQ=; b=Oqfg10CmIlcrtPhQ14KeebijSp/qgdgTqRL9M8S33tQF1ONvsJlvBbemkXhrlTWXFr SJBK7WA7AmOvvYjOc+5OCjxwZnUM6IWZX3vXApBIC3gXJHYGHjF3kz9KTZOgChnf/E1u k0peQ4H5Idl56ew0B2Yjr/tfKM0eiDUGWXOzvOSjD1ysaiKX12ZfZNNLZzYGM8ND0eAb GdDgtW2KQs6DONkzTE2+/uZU+KTIgWlYIjRpnrTs7QIahYjQgZZk81UiljweiR8fdGVp M/h1W+gL2UOsDqxwiAHWqkz6K7kdE9HMq01LisNhBSrmJ8XVHo3PkMzlkQmo+myDaHuD U2AA== X-Gm-Message-State: AOJu0YwvHF0F6CIW/gVRfGXODv1T3QdW1CgoZbhgQk6NAPpJ6q1yDJwE RGO3t9PngnrnE0zhXXGUoUCw35CJ7cDrfMcZw1w1OgZ7L3pjuZGWA4uVab+W/zff7BJY0vi3P33 64ns= X-Gm-Gg: ASbGncuwRw4dv1OTAglsygoq9BjCB/i6MTU9ow2We5At/OXoxR4LSjmRrqMJUd+/4kt 48TRcbh8A0kpDaPNG50egLeFD1K47wg6y2dhnh0oSGO2mHSmcB/401U9R6vqRv9dN5/jaHc4Nob zGE6v2r7QhdPsuMRl/eTt69EUuM8ikSMDqmB2ELIIsqkAia4lkMYpnUi4ggiuMq4FeleSt3Fp5B jWINV60HZeL1C9mWY8/jIB2Kda8dfw0ciQ9z99j/j0p2ly7EFs03CgZTb0WpylxIvoumGe4N/S4 sXya X-Google-Smtp-Source: AGHT+IGP1J64S6+QDhB4XvCBX4x76xPkUxupnujOwXxnwyVOp2bvKPLHAFsDBmQwIKFW7DPzXY9A1A== X-Received: by 2002:a05:6a20:1596:b0:1e1:b12e:edb8 with SMTP id adf61e73a8af0-1ed7a6b168cmr21244217637.30.1738332942013; Fri, 31 Jan 2025 06:15:42 -0800 (PST) Received: from hexa.. ([98.142.47.158]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-72fe6a1a958sm3412644b3a.172.2025.01.31.06.15.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jan 2025 06:15:41 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 3/4] gdb: Fix CVE-2024-53589 Date: Fri, 31 Jan 2025 06:15:29 -0800 Message-ID: <4ddd1e5aea1c4b84a6c4e1db5ded4938c4a35393.1738332771.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jan 2025 14:15:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/210485 From: Yash Shinde CVE: CVE-2024-53589 Signed-off-by: Yash Shinde Signed-off-by: Steve Sakoman --- meta/recipes-devtools/gdb/gdb.inc | 1 + .../gdb/gdb/0014-CVE-2024-53589.patch | 92 +++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch diff --git a/meta/recipes-devtools/gdb/gdb.inc b/meta/recipes-devtools/gdb/gdb.inc index 6c9fe60cab..84cc65f79b 100644 --- a/meta/recipes-devtools/gdb/gdb.inc +++ b/meta/recipes-devtools/gdb/gdb.inc @@ -17,5 +17,6 @@ SRC_URI = "${GNU_MIRROR}/gdb/gdb-${PV}.tar.xz \ file://0011-CVE-2023-39128.patch \ file://0012-CVE-2023-39129.patch \ file://0013-CVE-2023-39130.patch \ + file://0014-CVE-2024-53589.patch \ " SRC_URI[sha256sum] = "1497c36a71881b8671a9a84a0ee40faab788ca30d7ba19d8463c3cc787152e32" diff --git a/meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch b/meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch new file mode 100644 index 0000000000..380112a3ba --- /dev/null +++ b/meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch @@ -0,0 +1,92 @@ +Author: Alan Modra +Date: Mon Nov 11 10:24:09 2024 +1030 + + Re: tekhex object file output fixes + + Commit 8b5a212495 supported *ABS* symbols by allowing "section" to be + bfd_abs_section, but bfd_abs_section needs to be treated specially. + In particular, bfd_get_next_section_by_name (.., bfd_abs_section_ptr) + is invalid. + + PR 32347 + * tekhex.c (first_phase): Guard against modification of + _bfd_std_section[] entries. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] +CVE: CVE-2024-53589 + +Signed-off-by: Yash Shinde + +diff --git a/bfd/tekhex.c b/bfd/tekhex.c +index aea2ebb23df..b305c1f96f1 100644 +--- a/bfd/tekhex.c ++++ b/bfd/tekhex.c +@@ -361,6 +361,7 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + asection *section, *alt_section; + unsigned int len; ++ bfd_vma addr; + bfd_vma val; + char sym[17]; /* A symbol can only be 16chars long. */ + +@@ -368,20 +369,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '6': + /* Data record - read it and store it. */ +- { +- bfd_vma addr; +- +- if (!getvalue (&src, &addr, src_end)) +- return false; +- +- while (*src && src < src_end - 1) +- { +- insert_byte (abfd, HEX (src), addr); +- src += 2; +- addr++; +- } +- return true; +- } ++ if (!getvalue (&src, &addr, src_end)) ++ return false; ++ ++ while (*src && src < src_end - 1) ++ { ++ insert_byte (abfd, HEX (src), addr); ++ src += 2; ++ addr++; ++ } ++ return true; + + case '3': + /* Symbol record, read the segment. */ +@@ -406,13 +403,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '1': /* Section range. */ + src++; +- if (!getvalue (&src, §ion->vma, src_end)) ++ if (!getvalue (&src, &addr, src_end)) + return false; + if (!getvalue (&src, &val, src_end)) + return false; +- if (val < section->vma) +- val = section->vma; +- section->size = val - section->vma; ++ if (bfd_is_const_section (section)) ++ break; ++ section->vma = addr; ++ if (val < addr) ++ val = addr; ++ section->size = val - addr; + /* PR 17512: file: objdump-s-endless-loop.tekhex. + Check for overlarge section sizes. */ + if (section->size & 0x80000000) +@@ -455,6 +455,8 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + new_symbol->symbol.flags = BSF_LOCAL; + if (stype == '2' || stype == '6') + new_symbol->symbol.section = bfd_abs_section_ptr; ++ else if (bfd_is_const_section (section)) ++ ; + else if (stype == '3' || stype == '7') + { + if ((section->flags & SEC_DATA) == 0) From patchwork Fri Jan 31 14:15:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 56370 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DD71C0218F for ; Fri, 31 Jan 2025 14:15:51 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.web10.20050.1738332944311039961 for ; Fri, 31 Jan 2025 06:15:44 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=HdvhDaHn; spf=softfail (domain: sakoman.com, ip: 209.85.214.169, mailfrom: steve@sakoman.com) Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-21619108a6bso35721955ad.3 for ; Fri, 31 Jan 2025 06:15:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1738332943; x=1738937743; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=JiTg7qrddR3OE9Rv0KnGHTnmQdorgHOoV4BX29Qz1KI=; b=HdvhDaHnpbGy1e7GTXUvkTkgPjuNJf5LAU/uhfsVC2BbliqErVGvZVF/g3I0nZup1/ OcFZUaWhNMKrnLmEbzWrU8XoUuFMCQtVIjIiX+siYtTCbLf4qT4TgfldX44Jjil0U13g NVntC0wPqud7/0SS7MKqVjD8ydI9ely42rueaKLfGQdXtWd33Gx+hbcfZ7jJNRWoFyA0 pliKgSwlbdi7sye6XuN+1THtsq9t1NaRlOwtRlAxCrTgcLEcJishgsDJKFHsS1XQbQjl j4mhfIYzkfyC7k8ydTrsg4QHhcM57CuBblEjNGbwyPmc0pRk2ZD0OB+VOiGVMUtmHrIU dxwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738332943; x=1738937743; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JiTg7qrddR3OE9Rv0KnGHTnmQdorgHOoV4BX29Qz1KI=; b=sTurdEDb7a1xDwUYYnzSbN8siF5l8WbbK9PPCdH14+01AHvrpcjJmrisrGra123cYT mTSo++8EXMaujZz6LNElcCLcLGxP6Empj2gPwKGRpbffRweEOj2v2QGxOyBatE4/Olw0 Mve9WewiMwgnnKinmgnWCqyXb1k+61uWOYRr0A/fFGlSZ5TxNRXuVluryFebT/oozqlI xM/SVHsRfHeW0I06Lp98KOKnhxkbCmLjBMAfW5EiSFd/W3yXEmD7HGdt+be+0G6Wiqsq v7463ZGq/Qjb7P0vHzeL71Boo9zAzM0m1q4NF8NQfZDz9PzH8jZGuFCx6S13jy0L4Ql9 cEow== X-Gm-Message-State: AOJu0YzXiHhZYl3Puw3AIBPH/SZ/cjYuRmLlP8EDlnxWZDISQLE7zTpW 5TDhFcuFDpAwdRUqVz9WBRoR60HIYtLrFzioi0CInHcpSaNiQODsaEd06zzcQmgvHtkPvMj+Kzi pJCc= X-Gm-Gg: ASbGncuH/XeYicmUPpvV9t/9d0FaThqUa8uQWp7NfrHPYGpbzGglz0zV4sjZE3aj4P6 h689vN3iPNpQMwj92sXWi4O7ns3y3L186Xa5nWj42i0WIRoLQBXdkMur3eNJaYIwHkxjQC0Fa8J hCbsh1p2W6Cy5grUGrbYUVPVp1TiUdWsJZSX7w+72de/heLB9aLT6p0glq/1yk7WqhnhRr9TD8F 7H4cS6jmZ5/dMKB9f7vsSECfYveT5ofmUB6tyKpCaFnnwg6voyni73Ahed4Xudcu5tPxe24fBNp RfGW X-Google-Smtp-Source: AGHT+IHGuGDaFpIv7QfEysYHhqRrs/kGefaIyOXSaW72Mzjgv7/t6s4da9m/2YWaP9w6siaZIJg4lw== X-Received: by 2002:a05:6a21:32a9:b0:1ea:f941:8d9b with SMTP id adf61e73a8af0-1ed7a623f50mr17250568637.38.1738332943440; Fri, 31 Jan 2025 06:15:43 -0800 (PST) Received: from hexa.. ([98.142.47.158]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-72fe6a1a958sm3412644b3a.172.2025.01.31.06.15.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jan 2025 06:15:43 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 4/4] glibc: stable 2.35 branch updates Date: Fri, 31 Jan 2025 06:15:30 -0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jan 2025 14:15:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/210486 From: Deepesh Varatharajan 549d831579 stdlib: Test using setenv with updated environ [BZ #32588] 8b5d4be762 Fix underallocation of abort_msg_s struct (CVE-2025-0395) 525e5f13de stdlib: Simplify buffer management in canonicalize 5eae275400 realpath: Bring back GNU extension on ENOENT and EACCES [BZ #28996] 8a82a76a42 realpath: Do not copy result on failure (BZ #28815) e369114462 misc: Add support for Linux uio.h RWF_NOAPPEND flag 3f1ab0ed66 nptl: Convert tst-setuid2 to test-driver 76adee6e0f support: Add xpthread_cond_signal wrapper c3beedeb70 elf: Support recursive use of dynamic TLS in interposed malloc f48d763ab8 elf: Avoid some free (NULL) calls in _dl_update_slotinfo 710057676d sysdeps/x86/Makefile: Split and sort tests a4207d4e83 x86: Only align destination to 1x VEC_SIZE in memset 4x loop 889f99c149 elf: Fix slow tls access after dlopen [BZ #19924] 543efedcb3 x86: Check the lower byte of EAX of CPUID leaf 2 [BZ #30643] 41a3e51233 x86_64: Add log1p with FMA 0d1c70aa4c x86_64: Add expm1 with FMA 516180d399 x86_64: Add log2 with FMA 30384b91ad x86_64: Sort fpu/multiarch/Makefile d626c31ce5 x86: Avoid integer truncation with large cache sizes (bug 32470) 7ea35e28b4 nptl: initialize cpu_id_start prior to rseq registration 47d70ca8d9 nptl: initialize rseq area prior to registration Signed-off-by: Deepesh Varatharajan Signed-off-by: Steve Sakoman --- meta/recipes-core/glibc/glibc-version.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index dc18d20dd8..d98b6a4911 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc @@ -1,6 +1,6 @@ SRCBRANCH ?= "release/2.35/master" PV = "2.35" -SRCREV_glibc ?= "37214df5f103f4075cf0a79a227e70f3e064701c" +SRCREV_glibc ?= "549d8315791aa8176ff1537db3e09c185c6e602f" SRCREV_localedef ?= "794da69788cbf9bf57b59a852f9f11307663fa87" GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git"