From patchwork Tue May 20 06:04:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: dchellam X-Patchwork-Id: 63270 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8904BC3ABDD for ; Tue, 20 May 2025 06:04:59 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.web10.14474.1747721098574380743 for ; Mon, 19 May 2025 23:04:58 -0700 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=7235df0036=divya.chellam@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54K3pm7Q031722 for ; Mon, 19 May 2025 23:04:58 -0700 Received: from ala-exchng01.corp.ad.wrs.com (ala-exchng01.wrs.com [147.11.82.252]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 46psykjgkb-9 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Mon, 19 May 2025 23:04:57 -0700 (PDT) Received: from blr-linux-engg1.wrs.com (147.11.136.210) by ala-exchng01.corp.ad.wrs.com (147.11.82.252) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.43; Mon, 19 May 2025 23:04:39 -0700 From: dchellam To: Subject: [OE-core][kirkstone][PATCH 1/1] busybox: fix CVE-2023-39810 Date: Tue, 20 May 2025 11:34:30 +0530 Message-ID: <20250520060430.4012177-1-divya.chellam@windriver.com> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 X-Originating-IP: [147.11.136.210] X-ClientProxiedBy: ala-exchng01.corp.ad.wrs.com (147.11.82.252) To ala-exchng01.corp.ad.wrs.com (147.11.82.252) X-Authority-Analysis: v=2.4 cv=a8kw9VSF c=1 sm=1 tr=0 ts=682c1b89 cx=c_pps a=/ZJR302f846pc/tyiSlYyQ==:117 a=/ZJR302f846pc/tyiSlYyQ==:17 a=HCiNrPZc1L8A:10 a=dt9VzEwgFbYA:10 a=PYnjg3YJAAAA:8 a=xNf9USuDAAAA:8 a=J0Tn2xNtAAAA:8 a=t7CeM3EgAAAA:8 a=mK_AVkanAAAA:8 a=9qxNCY_qAAAA:8 a=84eDFwQhqf-dJI7Y1qMA:9 a=9ZcRxastL33iXWX1AWsW:22 a=FdTzh2GWekK77mhwV6Dw:22 a=3gWm3jAn84ENXaBijsEo:22 X-Proofpoint-GUID: 1qYAqa2ihIgfb357MfUCE1vkHnYB2Xx6 X-Proofpoint-ORIG-GUID: 1qYAqa2ihIgfb357MfUCE1vkHnYB2Xx6 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTIwMDA0OCBTYWx0ZWRfX9oWnI3Jn9tTG wpL31omFj0mVlYJzXqM1n5cfw1jMR9R5wTBKVW2XjqWRrevNWBu/1xHvpvqFUwolOkvuREyhOLc mdYiNGS9bsIhfUyAw1Z+IydHstsiRliz4CdUS6en5F96F2XrvrpOWzyme3tFNo15c0cXwsWweqg As6qU5P6iaNM+punY1bOMwO6CfqjQZOG8YsjqxPQ6UM1Q4epJc2V/AR+UB89YlJ87qgd5cHtVP0 DuScOqdS7g2JWki5xne0CQplyki5L77Xr9tqdIOoiji9OEIBKH5lFTZdqta1vcUUiMmcmDcT+lq ZwWCY7EPH5GGmUxV+C/3p4ycqJfJUxAWhviK13hXy+0v7it3GKPiWtroZQw8oHNqfoy+JPKQp0r eRneiVaUfCUXUIReSo/Z2o3InX9NyridBKlGV9jBpoKCOv/Mf3OmZ1rT03APdI4kBEKRovZv X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-20_03,2025-05-16_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 malwarescore=0 lowpriorityscore=0 adultscore=0 spamscore=0 bulkscore=0 phishscore=0 impostorscore=0 mlxlogscore=999 mlxscore=0 priorityscore=1501 clxscore=1015 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.21.0-2505070000 definitions=main-2505200048 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 20 May 2025 06:04:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/216884 From: Divya Chellam An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. Note that the patch adds a config option which is disabled by default. So users wanting this feature needs to enable that option. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39810 https://security-tracker.debian.org/tracker/CVE-2023-39810 Upstream patch: https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3 Signed-off-by: Divya Chellam --- .../busybox/busybox/CVE-2023-39810.patch | 140 ++++++++++++++++++ meta/recipes-core/busybox/busybox_1.35.0.bb | 1 + 2 files changed, 141 insertions(+) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-39810.patch diff --git a/meta/recipes-core/busybox/busybox/CVE-2023-39810.patch b/meta/recipes-core/busybox/busybox/CVE-2023-39810.patch new file mode 100644 index 0000000000..b2be7437b8 --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2023-39810.patch @@ -0,0 +1,140 @@ +From 9a8796436b9b0641e13480811902ea2ac57881d3 Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko +Date: Wed, 2 Oct 2024 10:12:05 +0200 +Subject: [PATCH] archival: disallow path traversals (CVE-2023-39810) + +Create new configure option for archival/libarchive based extractions to +disallow path traversals. +As this is a paranoid option and might introduce backward +incompatibility, default it to no. + +Fixes: CVE-2023-39810 + +Based on the patch by Peter Kaestle + +function old new delta +data_extract_all 921 945 +24 +strip_unsafe_prefix 101 102 +1 +------------------------------------------------------------------------------ +(add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0) Total: 25 bytes + +Signed-off-by: Denys Vlasenko + +CVE: CVE-2023-39810 + +Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3] + +Signed-off-by: Divya Chellam +--- + archival/Config.src | 11 +++++++++++ + archival/libarchive/data_extract_all.c | 8 ++++++++ + archival/libarchive/unsafe_prefix.c | 6 +++++- + scripts/kconfig/lxdialog/check-lxdialog.sh | 2 +- + testsuite/cpio.tests | 23 ++++++++++++++++++++++ + 5 files changed, 48 insertions(+), 2 deletions(-) + +diff --git a/archival/Config.src b/archival/Config.src +index 6f4f30c..cbcd721 100644 +--- a/archival/Config.src ++++ b/archival/Config.src +@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST + This option reduces decompression time by about 25% at the cost of + a 1K bigger binary. + ++config FEATURE_PATH_TRAVERSAL_PROTECTION ++ bool "Prevent extraction of filenames with /../ path component" ++ default n ++ help ++ busybox tar and unzip remove "PREFIX/../" (if it exists) ++ from extracted names. ++ This option enables this behavior for all other unpacking applets, ++ such as cpio, ar, rpm. ++ GNU cpio 2.15 has NO such sanity check. ++# try other archivers and document their behavior? ++ + endmenu +diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c +index 049c2c1..8a69711 100644 +--- a/archival/libarchive/data_extract_all.c ++++ b/archival/libarchive/data_extract_all.c +@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle) + } while (--n != 0); + } + #endif ++#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION ++ /* Strip leading "/" and up to last "/../" path component */ ++ dst_name = (char *)strip_unsafe_prefix(dst_name); ++#endif ++// ^^^ This may be a problem if some applets do need to extract absolute names. ++// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag). ++// You might think that rpm needs it, but in my tests rpm's internal cpio ++// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO". + + if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) { + char *slash = strrchr(dst_name, '/'); +diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c +index 33e487b..6670811 100644 +--- a/archival/libarchive/unsafe_prefix.c ++++ b/archival/libarchive/unsafe_prefix.c +@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str) + cp++; + continue; + } +- if (is_prefixed_with(cp, "/../"+1)) { ++ /* We are called lots of times. ++ * is_prefixed_with(cp, "../") is slower than open-coding it, ++ * with minimal code growth (~few bytes). ++ */ ++ if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') { + cp += 3; + continue; + } +diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh +index 7003e02..b91a54b 100755 +--- a/scripts/kconfig/lxdialog/check-lxdialog.sh ++++ b/scripts/kconfig/lxdialog/check-lxdialog.sh +@@ -55,7 +55,7 @@ trap "rm -f $tmp" 0 1 2 3 15 + check() { + $cc -x c - -o $tmp 2>/dev/null <<'EOF' + #include CURSES_LOC +-main() {} ++int main() { return 0; } + EOF + if [ $? != 0 ]; then + echo " *** Unable to find the ncurses libraries or the" 1>&2 +diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests +index 85e7465..a4462c5 100755 +--- a/testsuite/cpio.tests ++++ b/testsuite/cpio.tests +@@ -154,6 +154,29 @@ testing "cpio -R with extract" \ + " "" "" + SKIP= + ++# Create an archive containing a file with "../dont_write" filename. ++# See that it will not be allowed to unpack. ++# NB: GNU cpio 2.15 DOES NOT do such checks. ++optional FEATURE_PATH_TRAVERSAL_PROTECTION ++rm -rf cpio.testdir ++mkdir -p cpio.testdir/prepare/inner ++echo "file outside of destination was written" > cpio.testdir/prepare/dont_write ++echo "data" > cpio.testdir/prepare/inner/to_extract ++mkdir -p cpio.testdir/extract ++testing "cpio extract file outside of destination" "\ ++(cd cpio.testdir/prepare/inner && echo -e '../dont_write\nto_extract' | cpio -o -H newc) | (cd cpio.testdir/extract && cpio -vi 2>&1) ++echo \$? ++ls cpio.testdir/dont_write 2>&1" \ ++"\ ++cpio: removing leading '../' from member names ++../dont_write ++to_extract ++1 blocks ++0 ++ls: cpio.testdir/dont_write: No such file or directory ++" "" "" ++SKIP= ++ + # Clean up + rm -rf cpio.testdir cpio.testdir2 2>/dev/null + +-- +2.40.0 diff --git a/meta/recipes-core/busybox/busybox_1.35.0.bb b/meta/recipes-core/busybox/busybox_1.35.0.bb index 6bffbbb5a8..1886410dd2 100644 --- a/meta/recipes-core/busybox/busybox_1.35.0.bb +++ b/meta/recipes-core/busybox/busybox_1.35.0.bb @@ -58,6 +58,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://CVE-2023-42364_42365-2.patch \ file://CVE-2023-42366.patch \ file://0001-cut-Fix-s-flag-to-omit-blank-lines.patch \ + file://CVE-2023-39810.patch \ " SRC_URI:append:libc-musl = " file://musl.cfg "