Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package procps for openSUSE:Factory checked in at 2023-08-16 14:16:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/procps (Old) and /work/SRC/openSUSE:Factory/.procps.new.11712 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "procps" Wed Aug 16 14:16:36 2023 rev:132 rq:1104044 version:3.3.17 Changes: -------- --- /work/SRC/openSUSE:Factory/procps/procps.changes 2023-01-10 14:59:35.925138387 +0100 +++ /work/SRC/openSUSE:Factory/.procps.new.11712/procps.changes 2023-08-16 14:16:52.250882820 +0200 @@ -1,0 +2,6 @@ +Tue Aug 15 12:24:00 UTC 2023 - Dr. Werner Fink <[email protected]> + +- Add patch CVE-2023-4016.patch + * CVE-2023-4016: ps buffer overflow (bsc#1214290) + +------------------------------------------------------------------- New: ---- CVE-2023-4016.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ procps.spec ++++++ --- /var/tmp/diff_new_pack.Xjz9g4/_old 2023-08-16 14:16:53.270889961 +0200 +++ /var/tmp/diff_new_pack.Xjz9g4/_new 2023-08-16 14:16:53.274889989 +0200 @@ -1,7 +1,7 @@ # # spec file for package procps # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -64,6 +64,8 @@ Patch34: procps-3.3.17-bsc1181976.patch # PATCH-FIX-UPSTREAM -- bsc#1195468 Patch35: bsc1195468-23da4f40.patch +# PATCH-FIX-UPSTREAM -- bsc#1214290 +Patch36: CVE-2023-4016.patch # PATCH-BACKPORT-FROM-UPSTREAM -- bsc#1181475: 'free' command reports misleading "used" value Patch42: procps-3.3.17-library-bsc1181475.patch Patch43: procps-3.3.17-top-bsc1181475.patch @@ -149,6 +151,7 @@ %patch33 -b .pmap4us %patch34 %patch35 -p1 +%patch36 -p0 %patch42 %patch43 ++++++ CVE-2023-4016.patch ++++++ >From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 From: Craig Small <[email protected]> Date: Thu, 10 Aug 2023 21:18:38 +1000 Subject: [PATCH] ps: Fix possible buffer overflow in -C option ps allocates memory using malloc(length of arg * len of struct). In certain strange circumstances, the arg length could be very large and the multiplecation will overflow, allocating a small amount of memory. Subsequent strncpy() will then write into unallocated memory. The fix is to use calloc. It's slower but this is a one-time allocation. Other malloc(x * y) calls have also been replaced by calloc(x, y) References: https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 https://nvd.nist.gov/vuln/detail/CVE-2023-4016 https://gitlab.com/procps-ng/procps/-/issues/297 https://bugs.debian.org/1042887 Signed-off-by: Craig Small <[email protected]> --- ps/parser.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) --- ps/parser.c +++ ps/parser.c 2023-08-15 12:19:13.375422122 +0000 @@ -183,8 +183,7 @@ static const char *parse_list(const char int need_item; const char *err; /* error code that could or did happen */ /*** prepare to operate ***/ - node = malloc(sizeof(selection_node)); - node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ + node = xmalloc(sizeof(selection_node)); node->n = 0; buf = strdup(arg); /*** sanity check and count items ***/ @@ -205,6 +204,7 @@ static const char *parse_list(const char } while (*++walk); if(need_item) goto parse_error; node->n = items; + node->u = xcalloc(items*sizeof(sel_union)); /*** actually parse the list ***/ walk = buf; while(items--){ @@ -569,8 +569,8 @@ static const char *parse_bsd_option(void /* put our tty on a tiny list */ { selection_node *node; - node = malloc(sizeof(selection_node)); - node->u = malloc(sizeof(sel_union)); + node = xmalloc(sizeof(selection_node)); + node->u = xmalloc(sizeof(sel_union)); node->u[0].tty = cached_tty; node->typecode = SEL_TTY; node->n = 1; @@ -706,8 +706,8 @@ static const char *parse_bsd_option(void if(!arg){ /* Wow, obsolete BSD syntax. Put our tty on a tiny list. */ selection_node *node; - node = malloc(sizeof(selection_node)); - node->u = malloc(sizeof(sel_union)); + node = xmalloc(sizeof(selection_node)); + node->u = xmalloc(sizeof(sel_union)); node->u[0].tty = cached_tty; node->typecode = SEL_TTY; node->n = 1; @@ -1030,16 +1030,16 @@ static const char *parse_trailing_pids(v argp = ps_argv + thisarg; thisarg = ps_argc - 1; /* we must be at the end now */ - pidnode = malloc(sizeof(selection_node)); - pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + pidnode = xmalloc(sizeof(selection_node)); + pidnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */ pidnode->n = 0; - grpnode = malloc(sizeof(selection_node)); - grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + grpnode = xmalloc(sizeof(selection_node)); + grpnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */ grpnode->n = 0; - sidnode = malloc(sizeof(selection_node)); - sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + sidnode = xmalloc(sizeof(selection_node)); + sidnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */ sidnode->n = 0; while(i--){ --- proc/libprocps.sym +++ proc/libprocps.sym 2023-08-15 12:43:18.905661726 +0000 @@ -67,6 +67,8 @@ global: unix_print_signals; uptime; xalloc_err_handler; + xcalloc; + xmalloc; local: *; };
