From patchwork Thu Aug 14 17:43:48 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 68524 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 098F6CA0EE4 for ; Thu, 14 Aug 2025 17:44:54 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.web10.28821.1755193480909763866 for ; Thu, 14 Aug 2025 10:44:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=JbsJ9pTd; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-2025081417443730d838aa88658926ad-imga70@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 2025081417443730d838aa88658926ad for ; Thu, 14 Aug 2025 19:44:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding; bh=Wzb4CWUuSIMknbxPasA8z5NAILba3oKxOyyAbIuVfAg=; b=JbsJ9pTdLXpUuY3kz010yVbjLbp7Kwy9aNhfl2xoBPB7pn1FZrvEb0ho7f8Vb6fYE13hin kjINbJacovIjH8y0IWf0CPmNneOe/GrUPZgNfC1invIUwvBrYStn09bmfA4uiTUtCZZXRkQe +K+wu/3WMRevgz9+cskbTw83UBhwhI+yVO5hNTp/x4XMrS3/z1mOD9oR+Les/e5K/BFUw5mn 1s6Q0NPUnW8UBudiCrq/RYo2Bjujc+vGxwdS7xIzCY9WCfpFC3FciqwVwZ4tRcgALiHTyIQg waZTiMhHW5qtZEdNlSjNWfX2iV39Zo2o9voFwbxSJFDncJDlBkH8bqTg==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Subject: [meta-networking][walnascar][PATCH 1/5] corosync: fix upstream version check Date: Thu, 14 Aug 2025 19:43:48 +0200 Message-Id: <20250814174352.10670-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 14 Aug 2025 17:44:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/118937 From: Peter Marko github-releases is needed that it work at all: ERROR: Automatic discovery of latest version/revision failed - you must provide a version using the --version/-V option, or for recipes that fetch from an SCM such as git, the --srcrev/-S option. UPSTREAM_CHECK_GITTAGREGEX is needed to get correct version, otherwise: $ devtool latest-version corosync ... INFO: Current version: 3.1.6 INFO: Latest version: 414.336.75.75.75 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- meta-networking/recipes-extended/corosync/corosync_3.1.6.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb b/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb index cbbbbc70cd..e8e4540a21 100644 --- a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb +++ b/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb @@ -5,13 +5,13 @@ HOMEPAGE = "http://corosync.github.io/corosync/" SECTION = "base" -inherit autotools pkgconfig systemd +inherit autotools pkgconfig systemd github-releases -SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/v${PV}/${BP}.tar.gz \ +SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \ file://corosync.conf \ " SRC_URI[sha256sum] = "ca6ed32b4d7f33ed614afce8760fe58d0de92c68b575d4969ebacd892f3d1e27" -UPSTREAM_CHECK_REGEX = "(?P\d+\.(?!99)\d+(\.\d+)+)" +UPSTREAM_CHECK_GITTAGREGEX = "v(?P\d+(\.\d+)+)" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=a85eb4ce24033adb6088dd1d6ffc5e5d" From patchwork Thu Aug 14 17:43:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 68522 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E38ACA0EDC for ; Thu, 14 Aug 2025 17:44:44 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web10.28823.1755193481387606545 for ; Thu, 14 Aug 2025 10:44:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=TpRHj1k0; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-20250814174437e3377d28926df7f2eb-evkv6a@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20250814174437e3377d28926df7f2eb for ; Thu, 14 Aug 2025 19:44:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:References:In-Reply-To; bh=RXPUpgEWi/TXPtvZuX+Mri8R2hAR4mspnapwbAB8JIc=; b=TpRHj1k0hZd2LnfTK9sTBnP5fBvx9N2KZ1reWm6y/3IS3StkT2feNmNdDgOwWTGti3hxHV cJd/HR5pWHIljvqKufPybUcJIVOzU63Yj5T9dUT5LGjWnf5FDQe7IVNj1WKm3gtJrSjLSB0/ aPOHz79kBgjruF6RKm2h1SECbNfELcYkqu+okjuHdVqmPDZEzxRnn6aeLmV5W5VSJtIQ4mbB ckuzqR8PQ48dzPxYxllYY0aq0G6fLbUF7HyyLN9D4esHpiOEE52xKYQedkNLYUsCr3OZ5EIw sp5wVcolR0bURC4sHxIwRz7wWqnrKp+zKVjw3qpjU0KIdPNWG0WSxoaA==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Subject: [meta-networking][walnascar][PATCH 2/5] corosync: upgrade 3.1.6 -> 3.1.9 Date: Thu, 14 Aug 2025 19:43:49 +0200 Message-Id: <20250814174352.10670-2-peter.marko@siemens.com> In-Reply-To: <20250814174352.10670-1-peter.marko@siemens.com> References: <20250814174352.10670-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 14 Aug 2025 17:44:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/118938 From: Peter Marko dbus dir was changed from sysconfdir to datadir drop unused configure code License-Update: copyright years refreshed Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- .../corosync/{corosync_3.1.6.bb => corosync_3.1.9.bb} | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) rename meta-networking/recipes-extended/corosync/{corosync_3.1.6.bb => corosync_3.1.9.bb} (90%) diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb similarity index 90% rename from meta-networking/recipes-extended/corosync/corosync_3.1.6.bb rename to meta-networking/recipes-extended/corosync/corosync_3.1.9.bb index e8e4540a21..af023307bb 100644 --- a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb +++ b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb @@ -10,11 +10,11 @@ inherit autotools pkgconfig systemd github-releases SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \ file://corosync.conf \ " -SRC_URI[sha256sum] = "ca6ed32b4d7f33ed614afce8760fe58d0de92c68b575d4969ebacd892f3d1e27" +SRC_URI[sha256sum] = "203354bbddee1a97b3c50a076eae89c635f406dd674ccaefc94bb9092acd9535" UPSTREAM_CHECK_GITTAGREGEX = "v(?P\d+(\.\d+)+)" LICENSE = "BSD-3-Clause" -LIC_FILES_CHKSUM = "file://LICENSE;md5=a85eb4ce24033adb6088dd1d6ffc5e5d" +LIC_FILES_CHKSUM = "file://LICENSE;md5=d9c2cca5d3448c43e52a399ad611658a" DEPENDS = "groff-native nss libqb kronosnet" @@ -34,11 +34,6 @@ PACKAGECONFIG[systemd] = "--enable-systemd --with-systemddir=${systemd_system_un EXTRA_OECONF = "ac_cv_path_BASHPATH=${base_bindir}/bash ap_cv_cc_pie=no" EXTRA_OEMAKE = "tmpfilesdir_DATA=" -#do_configure:prepend() { -# ( cd ${S} -# ${S}/autogen.sh ) -#} - do_install:append() { install -D -m 0644 ${UNPACKDIR}/corosync.conf ${D}${sysconfdir}/corosync/corosync.conf.example install -d ${D}${sysconfdir}/sysconfig/ @@ -59,5 +54,6 @@ do_install:append() { RDEPENDS:${PN} += "bash ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'sysvinit-pidof', 'procps', d)}" +FILES:${PN} += "${datadir}/dbus-1" FILES:${PN}-dbg += "${libexecdir}/lcrso/.debug" FILES:${PN}-doc += "${datadir}/snmp/mibs/COROSYNC-MIB.txt" From patchwork Thu Aug 14 17:43:50 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 68523 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CFFDCA0EE6 for ; Thu, 14 Aug 2025 17:44:54 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.web11.28778.1755193481050545092 for ; Thu, 14 Aug 2025 10:44:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=Lj29ei1S; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-20250814174437ece86bcc2c94377ed9-wcbe0c@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 20250814174437ece86bcc2c94377ed9 for ; Thu, 14 Aug 2025 19:44:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:References:In-Reply-To; bh=qAuiPmSwZ6Z9PgsYYKww/GHiuffRMaztzwQQdle5G84=; b=Lj29ei1SG3G4zd7CBgBvWyD801cI8i52RWHEhJdNHo4NJkeUWNdit2KsmGbsz3a7dkg8+x pNqtYkNx04mZijmiWe4znsT1h2tWD9xQE4sRcr1iu6VuASbKplONlR6Zt5INK9NOmGd/uPYy VvCX/lJoPQhSEDs49f+lgCMsxaMVKndAaRuvGYz3N13+TmWY++B7Opndedp+2ryVHkN5ME5p 4W6AN3mOd/drzqo/QlJNHx0YWKlBzCluq0sWUzMPN1ocF2XybmLo5bOLzJaFO33fu/tqa4bK 68p3aiu+cbpFbAagIIXBct0/5vL4HfBVoF/k+/ZB7M3TVGpRvykrs0+g==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Subject: [meta-networking][walnascar][PATCH 3/5] corosync: patch CVE-2025-30472 Date: Thu, 14 Aug 2025 19:43:50 +0200 Message-Id: <20250814174352.10670-3-peter.marko@siemens.com> In-Reply-To: <20250814174352.10670-1-peter.marko@siemens.com> References: <20250814174352.10670-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 14 Aug 2025 17:44:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/118940 From: Peter Marko Pick commit from [1] mentioned in [2] from [3] [1] https://github.com/corosync/corosync/issues/778 [2] https://github.com/corosync/corosync/pull/779 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-30472 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- .../corosync/corosync/CVE-2025-30472.patch | 69 +++++++++++++++++++ .../corosync/corosync_3.1.9.bb | 1 + 2 files changed, 70 insertions(+) create mode 100644 meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch new file mode 100644 index 0000000000..9b36dbe3fb --- /dev/null +++ b/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch @@ -0,0 +1,69 @@ +From 7839990f9cdf34e55435ed90109e82709032466a Mon Sep 17 00:00:00 2001 +From: Jan Friesse +Date: Mon, 24 Mar 2025 12:05:08 +0100 +Subject: [PATCH] totemsrp: Check size of orf_token msg + +orf_token message is stored into preallocated array on endian convert +so carefully crafted malicious message can lead to crash of corosync. + +Solution is to check message size beforehand. + +Signed-off-by: Jan Friesse +Reviewed-by: Christine Caulfield + +CVE: CVE-2025-30472 +Upstream-Status: Backport [https://github.com/corosync/corosync/commits/7839990f9cdf34e55435ed90109e82709032466a] +Signed-off-by: Peter Marko +--- + exec/totemsrp.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/exec/totemsrp.c b/exec/totemsrp.c +index 962d0e2a..364528ce 100644 +--- a/exec/totemsrp.c ++++ b/exec/totemsrp.c +@@ -3679,12 +3679,20 @@ static int check_orf_token_sanity( + const struct totemsrp_instance *instance, + const void *msg, + size_t msg_len, ++ size_t max_msg_len, + int endian_conversion_needed) + { + int rtr_entries; + const struct orf_token *token = (const struct orf_token *)msg; + size_t required_len; + ++ if (msg_len > max_msg_len) { ++ log_printf (instance->totemsrp_log_level_security, ++ "Received orf_token message is too long... ignoring."); ++ ++ return (-1); ++ } ++ + if (msg_len < sizeof(struct orf_token)) { + log_printf (instance->totemsrp_log_level_security, + "Received orf_token message is too short... ignoring."); +@@ -3698,6 +3706,13 @@ static int check_orf_token_sanity( + rtr_entries = token->rtr_list_entries; + } + ++ if (rtr_entries > RETRANSMIT_ENTRIES_MAX) { ++ log_printf (instance->totemsrp_log_level_security, ++ "Received orf_token message rtr_entries is corrupted... ignoring."); ++ ++ return (-1); ++ } ++ + required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item); + if (msg_len < required_len) { + log_printf (instance->totemsrp_log_level_security, +@@ -3868,7 +3883,8 @@ static int message_handler_orf_token ( + "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC); + #endif + +- if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) { ++ if (check_orf_token_sanity(instance, msg, msg_len, sizeof(token_storage), ++ endian_conversion_needed) == -1) { + return (0); + } + diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb index af023307bb..1699701c9d 100644 --- a/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb +++ b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb @@ -9,6 +9,7 @@ inherit autotools pkgconfig systemd github-releases SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \ file://corosync.conf \ + file://CVE-2025-30472.patch \ " SRC_URI[sha256sum] = "203354bbddee1a97b3c50a076eae89c635f406dd674ccaefc94bb9092acd9535" UPSTREAM_CHECK_GITTAGREGEX = "v(?P\d+(\.\d+)+)" From patchwork Thu Aug 14 17:43:51 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 68521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F11CCA0EE4 for ; Thu, 14 Aug 2025 17:44:44 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web10.28822.1755193481047178130 for ; Thu, 14 Aug 2025 10:44:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=GCSHTUp4; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20250814174437d07e2f73a7c9733aed-wum_qq@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20250814174437d07e2f73a7c9733aed for ; Thu, 14 Aug 2025 19:44:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:References:In-Reply-To; bh=qbuXncP8zTnwNemqkW7C6H3Am02C81bzfLkiOmu7EHo=; b=GCSHTUp4tdqBvlqAodrvsjd1M1KOkRwx4TETUAAm0/Pb+YkIPry2uEBs9WLyRwUaccTY+N svUiCyvI0fEwr/w9TQ9x9zyjgUFH5XjsQroPsD1PCAD0t2T8gkWJx9d/W/JNlvyR/t9XtHBI 05oxf8NnLP0syPNnqCGN1ISe/ICQxS7XNouimqXYQOHAhuLDETHCakGwj0MHDFLaLVxrfy+n W2T5w5GQcIqhW4bEl4Xhnm+gVgFD59NvWvG40bj4r813phHubZVlO4/1+qK/YKR0RueSWK4u TS4EOncq+d3Y1RthPAUm5FTc24c1sKw+hScurNsQORs0p8IB6v0YsFOg==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][walnascar][PATCH 4/5] libbpf: patch CVE-2025-29481 Date: Thu, 14 Aug 2025 19:43:51 +0200 Message-Id: <20250814174352.10670-4-peter.marko@siemens.com> In-Reply-To: <20250814174352.10670-1-peter.marko@siemens.com> References: <20250814174352.10670-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 14 Aug 2025 17:44:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/118941 From: Peter Marko Backport patch which mentions PoC [1] which is also linked from [2]. [1] https://github.com/libbpf/libbpf/commit/806b4e0a9f658d831119cece11a082ba1578b800 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-29481 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- .../libbpf/files/CVE-2025-29481.patch | 102 ++++++++++++++++++ meta-oe/recipes-kernel/libbpf/libbpf_1.5.0.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta-oe/recipes-kernel/libbpf/files/CVE-2025-29481.patch diff --git a/meta-oe/recipes-kernel/libbpf/files/CVE-2025-29481.patch b/meta-oe/recipes-kernel/libbpf/files/CVE-2025-29481.patch new file mode 100644 index 0000000000..ebfcb94a2f --- /dev/null +++ b/meta-oe/recipes-kernel/libbpf/files/CVE-2025-29481.patch @@ -0,0 +1,102 @@ +From 806b4e0a9f658d831119cece11a082ba1578b800 Mon Sep 17 00:00:00 2001 +From: Viktor Malik +Date: Tue, 15 Apr 2025 17:50:14 +0200 +Subject: [PATCH] libbpf: Fix buffer overflow in bpf_object__init_prog + +As shown in [1], it is possible to corrupt a BPF ELF file such that +arbitrary BPF instructions are loaded by libbpf. This can be done by +setting a symbol (BPF program) section offset to a large (unsigned) +number such that
overflows and points +before the section data in the memory. + +Consider the situation below where: +- prog_start = sec_start + symbol_offset <-- size_t overflow here +- prog_end = prog_start + prog_size + + prog_start sec_start prog_end sec_end + | | | | + v v v v + .....................|################################|............ + +The report in [1] also provides a corrupted BPF ELF which can be used as +a reproducer: + + $ readelf -S crash + Section Headers: + [Nr] Name Type Address Offset + Size EntSize Flags Link Info Align + ... + [ 2] uretprobe.mu[...] PROGBITS 0000000000000000 00000040 + 0000000000000068 0000000000000000 AX 0 0 8 + + $ readelf -s crash + Symbol table '.symtab' contains 8 entries: + Num: Value Size Type Bind Vis Ndx Name + ... + 6: ffffffffffffffb8 104 FUNC GLOBAL DEFAULT 2 handle_tp + +Here, the handle_tp prog has section offset ffffffffffffffb8, i.e. will +point before the actual memory where section 2 is allocated. + +This is also reported by AddressSanitizer: + + ================================================================= + ==1232==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c7302fe0000 at pc 0x7fc3046e4b77 bp 0x7ffe64677cd0 sp 0x7ffe64677490 + READ of size 104 at 0x7c7302fe0000 thread T0 + #0 0x7fc3046e4b76 in memcpy (/lib64/libasan.so.8+0xe4b76) + #1 0x00000040df3e in bpf_object__init_prog /src/libbpf/src/libbpf.c:856 + #2 0x00000040df3e in bpf_object__add_programs /src/libbpf/src/libbpf.c:928 + #3 0x00000040df3e in bpf_object__elf_collect /src/libbpf/src/libbpf.c:3930 + #4 0x00000040df3e in bpf_object_open /src/libbpf/src/libbpf.c:8067 + #5 0x00000040f176 in bpf_object__open_file /src/libbpf/src/libbpf.c:8090 + #6 0x000000400c16 in main /poc/poc.c:8 + #7 0x7fc3043d25b4 in __libc_start_call_main (/lib64/libc.so.6+0x35b4) + #8 0x7fc3043d2667 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x3667) + #9 0x000000400b34 in _start (/poc/poc+0x400b34) + + 0x7c7302fe0000 is located 64 bytes before 104-byte region [0x7c7302fe0040,0x7c7302fe00a8) + allocated by thread T0 here: + #0 0x7fc3046e716b in malloc (/lib64/libasan.so.8+0xe716b) + #1 0x7fc3045ee600 in __libelf_set_rawdata_wrlock (/lib64/libelf.so.1+0xb600) + #2 0x7fc3045ef018 in __elf_getdata_rdlock (/lib64/libelf.so.1+0xc018) + #3 0x00000040642f in elf_sec_data /src/libbpf/src/libbpf.c:3740 + +The problem here is that currently, libbpf only checks that the program +end is within the section bounds. There used to be a check +`while (sec_off < sec_sz)` in bpf_object__add_programs, however, it was +removed by commit 6245947c1b3c ("libbpf: Allow gaps in BPF program +sections to support overriden weak functions"). + +Add a check for detecting the overflow of `sec_off + prog_sz` to +bpf_object__init_prog to fix this issue. + +[1] https://github.com/lmarch2/poc/blob/main/libbpf/libbpf.md + +Fixes: 6245947c1b3c ("libbpf: Allow gaps in BPF program sections to support overriden weak functions") +Reported-by: lmarch2 <2524158037@qq.com> +Signed-off-by: Viktor Malik +Signed-off-by: Andrii Nakryiko +Reviewed-by: Shung-Hsi Yu +Link: https://github.com/lmarch2/poc/blob/main/libbpf/libbpf.md +Link: https://lore.kernel.org/bpf/20250415155014.397603-1-vmalik@redhat.com + +CVE: CVE-2025-29481 +Upstream-Status: Backport [https://github.com/libbpf/libbpf/commit/806b4e0a9f658d831119cece11a082ba1578b800] +Signed-off-by: Peter Marko +--- + src/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/libbpf.c b/src/libbpf.c +index b2591f5..56250b5 100644 +--- a/src/libbpf.c ++++ b/src/libbpf.c +@@ -889,7 +889,7 @@ bpf_object__add_programs(struct bpf_object *obj, Elf_Data *sec_data, + return -LIBBPF_ERRNO__FORMAT; + } + +- if (sec_off + prog_sz > sec_sz) { ++ if (sec_off + prog_sz > sec_sz || sec_off + prog_sz < sec_off) { + pr_warn("sec '%s': program at offset %zu crosses section boundary\n", + sec_name, sec_off); + return -LIBBPF_ERRNO__FORMAT; diff --git a/meta-oe/recipes-kernel/libbpf/libbpf_1.5.0.bb b/meta-oe/recipes-kernel/libbpf/libbpf_1.5.0.bb index 58bb7bca09..45caca0114 100644 --- a/meta-oe/recipes-kernel/libbpf/libbpf_1.5.0.bb +++ b/meta-oe/recipes-kernel/libbpf/libbpf_1.5.0.bb @@ -10,6 +10,7 @@ DEPENDS = "zlib elfutils" SRC_URI = "git://github.com/libbpf/libbpf.git;protocol=https;branch=master \ file://0001-libbpf-check-for-empty-BTF-data-section-in-btf_parse.patch \ + file://CVE-2025-29481.patch;striplevel=2 \ " SRCREV = "09b9e83102eb8ab9e540d36b4559c55f3bcdb95d" From patchwork Thu Aug 14 17:43:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 68525 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16582CA0EDC for ; Thu, 14 Aug 2025 17:44:54 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web10.28820.1755193480909496733 for ; Thu, 14 Aug 2025 10:44:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=f3CAMP/E; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-202508141744378fbfcc01e49e7fad3e-ykiova@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 202508141744378fbfcc01e49e7fad3e for ; Thu, 14 Aug 2025 19:44:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:References:In-Reply-To; bh=+rSE/64QN9ZMu46sHjfHtb42MrhaHZ8OcdggsT6qhC8=; b=f3CAMP/EdDAys8T73fnxl775EzASH5raV+Ib+xV+nGW4TsyPsi6kzRAaYyemKbmlzyRBWE qBTIyRSMtzZNdMgG/Xy//wFfc3NLgCNWOmPLWkCD/S5kliTlR6HbdALEn25gypJJC6Yo0SpM 6OBvDNGqXhFAPIPGlIwwZQv0d9I6qd56Mh7THDu5yRSvzE23Ip33c2xRVl9zsh7Gm6jrQMcM AY1/E1WDELaabXgjm0eFH8/aSHpBbuBAwjdtGAffwQ/p2IIkeHeeWqLX9QQ1h6hoKdgplUjN idKbV6HLfq/GDvX8jxJB9tRABpmW4Pwud4KQ84NWJxQzTAOTYXtb++4A==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][walnascar][PATCH 5/5] fontforge: patch CVE-2024-25081 and CVE-2024-25082 Date: Thu, 14 Aug 2025 19:43:52 +0200 Message-Id: <20250814174352.10670-5-peter.marko@siemens.com> In-Reply-To: <20250814174352.10670-1-peter.marko@siemens.com> References: <20250814174352.10670-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 14 Aug 2025 17:44:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/118939 From: Peter Marko Pick commit from PR [1] linked from [2] and [3] which mlso entions both these CVEs. [1] https://github.com/fontforge/fontforge/pull/5367 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-25081 [3] https://nvd.nist.gov/vuln/detail/CVE-2024-25082 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- .../CVE-2024-25081_CVE-2024-25082.patch | 181 ++++++++++++++++++ .../fontforge/fontforge_20230101.bb | 1 + 2 files changed, 182 insertions(+) create mode 100644 meta-oe/recipes-graphics/fontforge/fontforge/CVE-2024-25081_CVE-2024-25082.patch diff --git a/meta-oe/recipes-graphics/fontforge/fontforge/CVE-2024-25081_CVE-2024-25082.patch b/meta-oe/recipes-graphics/fontforge/fontforge/CVE-2024-25081_CVE-2024-25082.patch new file mode 100644 index 0000000000..40f85e9f33 --- /dev/null +++ b/meta-oe/recipes-graphics/fontforge/fontforge/CVE-2024-25081_CVE-2024-25082.patch @@ -0,0 +1,181 @@ +From 216eb14b558df344b206bf82e2bdaf03a1f2f429 Mon Sep 17 00:00:00 2001 +From: Peter Kydas +Date: Tue, 6 Feb 2024 20:03:04 +1100 +Subject: [PATCH] fix splinefont shell command injection (#5367) + +CVE: CVE-2024-25081 +CVE: CVE-2024-25082 +Upstream-Status: Backport [https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429] +Signed-off-by: Peter Marko +--- + fontforge/splinefont.c | 123 +++++++++++++++++++++++++++++------------ + 1 file changed, 89 insertions(+), 34 deletions(-) + +diff --git a/fontforge/splinefont.c b/fontforge/splinefont.c +index 239fdc035..647daee10 100644 +--- a/fontforge/splinefont.c ++++ b/fontforge/splinefont.c +@@ -788,11 +788,14 @@ return( name ); + + char *Unarchive(char *name, char **_archivedir) { + char *dir = getenv("TMPDIR"); +- char *pt, *archivedir, *listfile, *listcommand, *unarchivecmd, *desiredfile; ++ char *pt, *archivedir, *listfile, *desiredfile; + char *finalfile; + int i; + int doall=false; + static int cnt=0; ++ gchar *command[5]; ++ gchar *stdoutresponse = NULL; ++ gchar *stderrresponse = NULL; + + *_archivedir = NULL; + +@@ -827,18 +830,30 @@ return( NULL ); + listfile = malloc(strlen(archivedir)+strlen("/" TOC_NAME)+1); + sprintf( listfile, "%s/" TOC_NAME, archivedir ); + +- listcommand = malloc( strlen(archivers[i].unarchive) + 1 + +- strlen( archivers[i].listargs) + 1 + +- strlen( name ) + 3 + +- strlen( listfile ) +4 ); +- sprintf( listcommand, "%s %s %s > %s", archivers[i].unarchive, +- archivers[i].listargs, name, listfile ); +- if ( system(listcommand)!=0 ) { +- free(listcommand); free(listfile); +- ArchiveCleanup(archivedir); +-return( NULL ); ++ command[0] = archivers[i].unarchive; ++ command[1] = archivers[i].listargs; ++ command[2] = name; ++ command[3] = NULL; // command args need to be NULL-terminated ++ ++ if ( g_spawn_sync( ++ NULL, ++ command, ++ NULL, ++ G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ &stdoutresponse, ++ &stderrresponse, ++ NULL, ++ NULL ++ ) == FALSE) { // did not successfully execute ++ ArchiveCleanup(archivedir); ++ return( NULL ); + } +- free(listcommand); ++ // Write out the listfile to be read in later ++ FILE *fp = fopen(listfile, "wb"); ++ fwrite(stdoutresponse, strlen(stdoutresponse), 1, fp); ++ fclose(fp); + + desiredfile = ArchiveParseTOC(listfile, archivers[i].ars, &doall); + free(listfile); +@@ -847,22 +862,28 @@ return( NULL ); + return( NULL ); + } + +- /* I tried sending everything to stdout, but that doesn't work if the */ +- /* output is a directory file (ufo, sfdir) */ +- unarchivecmd = malloc( strlen(archivers[i].unarchive) + 1 + +- strlen( archivers[i].listargs) + 1 + +- strlen( name ) + 1 + +- strlen( desiredfile ) + 3 + +- strlen( archivedir ) + 30 ); +- sprintf( unarchivecmd, "( cd %s ; %s %s %s %s ) > /dev/null", archivedir, +- archivers[i].unarchive, +- archivers[i].extractargs, name, doall ? "" : desiredfile ); +- if ( system(unarchivecmd)!=0 ) { +- free(unarchivecmd); free(desiredfile); +- ArchiveCleanup(archivedir); +-return( NULL ); ++ command[0] = archivers[i].unarchive; ++ command[1] = archivers[i].extractargs; ++ command[2] = name; ++ command[3] = doall ? "" : desiredfile; ++ command[4] = NULL; ++ ++ if ( g_spawn_sync( ++ (gchar*)archivedir, ++ command, ++ NULL, ++ G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ &stdoutresponse, ++ &stderrresponse, ++ NULL, ++ NULL ++ ) == FALSE) { // did not successfully execute ++ free(desiredfile); ++ ArchiveCleanup(archivedir); ++ return( NULL ); + } +- free(unarchivecmd); + + finalfile = malloc( strlen(archivedir) + 1 + strlen(desiredfile) + 1); + sprintf( finalfile, "%s/%s", archivedir, desiredfile ); +@@ -885,20 +906,54 @@ struct compressors compressors[] = { + + char *Decompress(char *name, int compression) { + char *dir = getenv("TMPDIR"); +- char buf[1500]; + char *tmpfn; +- ++ gchar *command[4]; ++ gint stdout_pipe; ++ gchar buffer[4096]; ++ gssize bytes_read; ++ GByteArray *binary_data = g_byte_array_new(); ++ + if ( dir==NULL ) dir = P_tmpdir; + tmpfn = malloc(strlen(dir)+strlen(GFileNameTail(name))+2); + strcpy(tmpfn,dir); + strcat(tmpfn,"/"); + strcat(tmpfn,GFileNameTail(name)); + *strrchr(tmpfn,'.') = '\0'; +- snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfn ); +- if ( system(buf)==0 ) +-return( tmpfn ); +- free(tmpfn); +-return( NULL ); ++ ++ command[0] = compressors[compression].decomp; ++ command[1] = "-c"; ++ command[2] = name; ++ command[3] = NULL; ++ ++ // Have to use async because g_spawn_sync doesn't handle nul-bytes in the output (which happens with binary data) ++ if (g_spawn_async_with_pipes( ++ NULL, ++ command, ++ NULL, ++ G_SPAWN_DO_NOT_REAP_CHILD | G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ NULL, ++ NULL, ++ &stdout_pipe, ++ NULL, ++ NULL) == FALSE) { ++ //command has failed ++ return( NULL ); ++ } ++ ++ // Read binary data from pipe and output to file ++ while ((bytes_read = read(stdout_pipe, buffer, sizeof(buffer))) > 0) { ++ g_byte_array_append(binary_data, (guint8 *)buffer, bytes_read); ++ } ++ close(stdout_pipe); ++ ++ FILE *fp = fopen(tmpfn, "wb"); ++ fwrite(binary_data->data, sizeof(gchar), binary_data->len, fp); ++ fclose(fp); ++ g_byte_array_free(binary_data, TRUE); ++ ++ return(tmpfn); + } + + static char *ForceFileToHaveName(FILE *file, char *exten) { diff --git a/meta-oe/recipes-graphics/fontforge/fontforge_20230101.bb b/meta-oe/recipes-graphics/fontforge/fontforge_20230101.bb index 31dd495fd7..d470ff12d4 100644 --- a/meta-oe/recipes-graphics/fontforge/fontforge_20230101.bb +++ b/meta-oe/recipes-graphics/fontforge/fontforge_20230101.bb @@ -20,6 +20,7 @@ SRC_URI = "git://github.com/${BPN}/${BPN}.git;branch=master;protocol=https \ file://0001-fontforgeexe-Use-env-to-find-fontforge.patch \ file://0001-cmake-Use-alternate-way-to-detect-libm.patch \ file://0001-Fix-Translations-containing-invalid-directives-hs.patch \ + file://CVE-2024-25081_CVE-2024-25082.patch \ " S = "${WORKDIR}/git"