Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package procps4 for openSUSE:Factory checked in at 2023-08-17 19:44:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/procps4 (Old) and /work/SRC/openSUSE:Factory/.procps4.new.1766 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "procps4" Thu Aug 17 19:44:42 2023 rev:4 rq:1104338 version:4.0.3 Changes: -------- --- /work/SRC/openSUSE:Factory/procps4/procps4.changes 2023-02-20 17:47:57.436144596 +0100 +++ /work/SRC/openSUSE:Factory/.procps4.new.1766/procps4.changes 2023-08-17 19:44:58.798950355 +0200 @@ -1,0 +2,6 @@ +Tue Aug 15 12:24:00 UTC 2023 - Dr. Werner Fink <[email protected]> + +- Add patch CVE-2023-4016.patch + * CVE-2023-4016: ps buffer overflow (bsc#1214290) + +------------------------------------------------------------------- New: ---- CVE-2023-4016.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ procps4.spec ++++++ --- /var/tmp/diff_new_pack.kpM8Hb/_old 2023-08-17 19:44:59.850952322 +0200 +++ /var/tmp/diff_new_pack.kpM8Hb/_new 2023-08-17 19:44:59.862952344 +0200 @@ -58,6 +58,8 @@ Patch33: procps-ng-3.3.11-pmap4suse.patch # PATCH-FIX-SUSE -- Avoid float errors on 32bit architectures Patch37: procps-ng-4.0.0-floats.dif +# PATCH-FIX-UPSTREAM -- bsc#1214290 +Patch38: CVE-2023-4016.patch BuildRequires: automake BuildRequires: dejagnu BuildRequires: diffutils @@ -146,6 +148,7 @@ %patch32 %patch33 -b .pmap4us %patch37 +%patch38 %build test -s .tarball-version || echo %{version} > .tarball-version ++++++ CVE-2023-4016.patch ++++++ >From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 From: Craig Small <[email protected]> Date: Thu, 10 Aug 2023 21:18:38 +1000 Subject: [PATCH] ps: Fix possible buffer overflow in -C option ps allocates memory using malloc(length of arg * len of struct). In certain strange circumstances, the arg length could be very large and the multiplecation will overflow, allocating a small amount of memory. Subsequent strncpy() will then write into unallocated memory. The fix is to use calloc. It's slower but this is a one-time allocation. Other malloc(x * y) calls have also been replaced by calloc(x, y) References: https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 https://nvd.nist.gov/vuln/detail/CVE-2023-4016 https://gitlab.com/procps-ng/procps/-/issues/297 https://bugs.debian.org/1042887 Signed-off-by: Craig Small <[email protected]> --- NEWS | 2 ++ src/ps/parser.c | 8 ++++---- 2 files changed, 6 insertions(+), 4 deletions(-) --- NEWS +++ NEWS 2023-08-17 08:31:14.427539989 +0000 @@ -1,3 +1,5 @@ + * ps: Fix buffer overflow in -C option CVE-2023-4016 Debian #1042887, issue #297 + procps-ng-4.0.3 --------------- * library --- src/ps/parser.c +++ src/ps/parser.c 2023-08-17 08:25:44.101480434 +0000 @@ -189,7 +189,6 @@ static const char *parse_list(const char const char *err; /* error code that could or did happen */ /*** prepare to operate ***/ node = xmalloc(sizeof(selection_node)); - node->u = xmalloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ node->n = 0; buf = strdup(arg); /*** sanity check and count items ***/ @@ -210,6 +209,7 @@ static const char *parse_list(const char } while (*++walk); if(need_item) goto parse_error; node->n = items; + node->u = xcalloc(items, sizeof(sel_union)); /*** actually parse the list ***/ walk = buf; while(items--){ @@ -1050,15 +1050,15 @@ static const char *parse_trailing_pids(v thisarg = ps_argc - 1; /* we must be at the end now */ pidnode = xmalloc(sizeof(selection_node)); - pidnode->u = xmalloc(i*sizeof(sel_union)); /* waste is insignificant */ + pidnode->u = xcalloc(i, sizeof(sel_union)); /* waste is insignificant */ pidnode->n = 0; grpnode = xmalloc(sizeof(selection_node)); - grpnode->u = xmalloc(i*sizeof(sel_union)); /* waste is insignificant */ + grpnode->u = xcalloc(i,sizeof(sel_union)); /* waste is insignificant */ grpnode->n = 0; sidnode = xmalloc(sizeof(selection_node)); - sidnode->u = xmalloc(i*sizeof(sel_union)); /* waste is insignificant */ + sidnode->u = xcalloc(i, sizeof(sel_union)); /* waste is insignificant */ sidnode->n = 0; while(i--){
