commit: b74dc7a9c13b34133d3691993afdbebd7dd0f59e Author: Fabian Groffen <grobian <AT> gentoo <DOT> org> AuthorDate: Wed Oct 19 07:51:00 2022 +0000 Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org> CommitDate: Wed Oct 19 07:53:31 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b74dc7a9
mail-mta/exim: revbumps for use-after-free fixes, CVE-2022-3559, cleanup Bug: https://bugs.gentoo.org/877607 Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org> mail-mta/exim/exim-4.94.2-r7.ebuild | 11 +-- ...exim-4.94.2-r8.ebuild => exim-4.94.2-r9.ebuild} | 12 +-- .../{exim-4.96-r1.ebuild => exim-4.96-r2.ebuild} | 12 +-- mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch | 99 ++++++++++++++++++++++ .../files/exim-4.96-dmarc_use_after_free.patch | 31 +++++++ 5 files changed, 141 insertions(+), 24 deletions(-) diff --git a/mail-mta/exim/exim-4.94.2-r7.ebuild b/mail-mta/exim/exim-4.94.2-r7.ebuild index 4d949c4c4c01..2c3b5101c59f 100644 --- a/mail-mta/exim/exim-4.94.2-r7.ebuild +++ b/mail-mta/exim/exim-4.94.2-r7.ebuild @@ -3,7 +3,7 @@ EAPI="7" -inherit db-use toolchain-funcs multilib pam systemd +inherit db-use toolchain-funcs pam systemd IUSE="arc +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl dsn exiscan-acl gnutls idn ipv6 ldap lmtp maildir mbx mysql nis pam perl pkcs11 postgres +prdr proxy radius redis sasl selinux spf sqlite srs +srs-alt srs-native +ssl syslog tcpd +tpda X" REQUIRED_USE=" @@ -89,18 +89,13 @@ DEPEND="${COMMON_DEPEND}" RDEPEND="${COMMON_DEPEND} !mail-mta/courier !mail-mta/esmtp - !mail-mta/mini-qmail - !<mail-mta/msmtp-1.4.19-r1 - !>=mail-mta/msmtp-1.4.19-r1[mta] + !mail-mta/msmtp[mta] !mail-mta/netqmail !mail-mta/nullmailer !mail-mta/postfix - !mail-mta/qmail-ldap !mail-mta/sendmail !mail-mta/opensmtpd - !<mail-mta/ssmtp-2.64-r2 - !>=mail-mta/ssmtp-2.64-r2[mta] - !net-mail/mailwrapper + !mail-mta/ssmtp[mta] >=net-mail/mailbase-0.00-r5 virtual/logger dcc? ( mail-filter/dcc ) diff --git a/mail-mta/exim/exim-4.94.2-r8.ebuild b/mail-mta/exim/exim-4.94.2-r9.ebuild similarity index 98% rename from mail-mta/exim/exim-4.94.2-r8.ebuild rename to mail-mta/exim/exim-4.94.2-r9.ebuild index 7cce1a0a02e3..c62c296b2534 100644 --- a/mail-mta/exim/exim-4.94.2-r8.ebuild +++ b/mail-mta/exim/exim-4.94.2-r9.ebuild @@ -3,7 +3,7 @@ EAPI="7" -inherit db-use toolchain-funcs multilib pam systemd +inherit db-use toolchain-funcs pam systemd IUSE="arc berkdb +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl dsn exiscan-acl gdbm gnutls idn ipv6 ldap lmtp maildir mbx @@ -97,18 +97,13 @@ DEPEND="${COMMON_DEPEND}" RDEPEND="${COMMON_DEPEND} !mail-mta/courier !mail-mta/esmtp - !mail-mta/mini-qmail - !<mail-mta/msmtp-1.4.19-r1 - !>=mail-mta/msmtp-1.4.19-r1[mta] + !mail-mta/msmtp[mta] !mail-mta/netqmail !mail-mta/nullmailer !mail-mta/postfix - !mail-mta/qmail-ldap !mail-mta/sendmail !mail-mta/opensmtpd - !<mail-mta/ssmtp-2.64-r2 - !>=mail-mta/ssmtp-2.64-r2[mta] - !net-mail/mailwrapper + !mail-mta/ssmtp[mta] >=net-mail/mailbase-0.00-r5 virtual/logger dcc? ( mail-filter/dcc ) @@ -126,6 +121,7 @@ src_prepare() { eapply "${FILESDIR}"/exim-4.69-r1.27021.patch eapply "${FILESDIR}"/exim-4.94-localscan_dlopen.patch eapply "${FILESDIR}"/exim-4.94.2-fix-crash-resolve.patch # 799368 upstr + eapply "${FILESDIR}"/exim-4.94-CVE-2022-3559.patch # 877607 upstr # for this reason we have a := dep on opendmarc, they changed their # API in a minor release diff --git a/mail-mta/exim/exim-4.96-r1.ebuild b/mail-mta/exim/exim-4.96-r2.ebuild similarity index 98% rename from mail-mta/exim/exim-4.96-r1.ebuild rename to mail-mta/exim/exim-4.96-r2.ebuild index 719ead900410..739a2fcdea96 100644 --- a/mail-mta/exim/exim-4.96-r1.ebuild +++ b/mail-mta/exim/exim-4.96-r2.ebuild @@ -3,7 +3,7 @@ EAPI="7" -inherit db-use toolchain-funcs multilib pam systemd +inherit db-use toolchain-funcs pam systemd IUSE="arc berkdb +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl dsn exiscan-acl gdbm gnutls idn ipv6 ldap lmtp maildir mbx @@ -93,18 +93,13 @@ DEPEND="${COMMON_DEPEND}" RDEPEND="${COMMON_DEPEND} !mail-mta/courier !mail-mta/esmtp - !mail-mta/mini-qmail - !<mail-mta/msmtp-1.4.19-r1 - !>=mail-mta/msmtp-1.4.19-r1[mta] + !mail-mta/msmtp[mta] !mail-mta/netqmail !mail-mta/nullmailer !mail-mta/postfix - !mail-mta/qmail-ldap !mail-mta/sendmail !mail-mta/opensmtpd - !<mail-mta/ssmtp-2.64-r2 - !>=mail-mta/ssmtp-2.64-r2[mta] - !net-mail/mailwrapper + !mail-mta/ssmtp[mta] >=net-mail/mailbase-0.00-r5 virtual/logger dcc? ( mail-filter/dcc ) @@ -121,6 +116,7 @@ src_prepare() { eapply -p0 "${FILESDIR}"/exim-4.76-crosscompile.patch # 266591 eapply "${FILESDIR}"/exim-4.69-r1.27021.patch eapply "${FILESDIR}"/exim-4.95-localscan_dlopen.patch + eapply -p2 "${FILESDIR}"/exim-4.96-dmarc_use_after_free.patch # upstr # oddity, they disable berkdb as hack, and then throw an error when # berkdb isn't enabled diff --git a/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch b/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch new file mode 100644 index 000000000000..9617c70d9e57 --- /dev/null +++ b/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch @@ -0,0 +1,99 @@ +Patch cleaned up for Gentoo +- applied to 4.94 +- removed unnecessary whitespace changes + +From 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146...@wizmail.org> +Date: Wed, 31 Aug 2022 15:37:40 +0100 +Subject: [PATCH 1/1] Fix $regex<n> use-after-free. Bug 2915 + +--- exim-4.94.2/src/exim.c 2021-04-30 14:08:21.000000000 +0200 ++++ exim-4.94.2/src/exim.c 2022-10-19 09:15:58.611447982 +0200 +@@ -1886,8 +1886,6 @@ + regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE); + #endif + +-for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; +- + /* If the program is called as "mailq" treat it as equivalent to "exim -bp"; + this seems to be a generally accepted convention, since one finds symbolic + links called "mailq" in standard OS configurations. */ +@@ -5841,7 +5839,7 @@ + deliver_localpart_data = deliver_domain_data = + recipient_data = sender_data = NULL; + acl_var_m = NULL; +- for(int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++ regex_vars_clear(); + + store_reset(reset_point); + } +--- exim-4.94.2/src/functions.h 2021-04-30 14:08:21.000000000 +0200 ++++ exim-4.94.2/src/functions.h 2022-10-19 09:17:44.882122667 +0200 +@@ -417,6 +417,7 @@ + #endif + extern BOOL regex_match_and_setup(const pcre *, const uschar *, int, int); + extern const pcre *regex_must_compile(const uschar *, BOOL, BOOL); ++extern void regex_vars_clear(void); + extern void retry_add_item(address_item *, uschar *, int); + extern BOOL retry_check_address(const uschar *, host_item *, uschar *, BOOL, + uschar **, uschar **); +--- exim-4.94.2/src/globals.c 2022-10-19 09:14:19.344751853 +0200 ++++ exim-4.94.2/src/globals.c 2022-10-19 09:18:27.675991666 +0200 +@@ -1289,7 +1289,7 @@ + #endif + const pcre *regex_ismsgid = NULL; + const pcre *regex_smtp_code = NULL; +-uschar *regex_vars[REGEX_VARS]; ++uschar *regex_vars[REGEX_VARS] = { 0 }; + #ifdef WHITELIST_D_MACROS + const pcre *regex_whitelisted_macro = NULL; + #endif +--- exim-4.94.2/src/regex.c 2021-04-30 14:08:21.000000000 +0200 ++++ exim-4.94.2/src/regex.c 2022-10-19 09:35:03.229084750 +0200 +@@ -87,6 +87,14 @@ + return FAIL; + } + ++/* reset expansion variables */ ++void ++regex_vars_clear(void) ++{ ++regex_match_string = NULL; ++for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++} ++ + int + regex(const uschar **listptr) + { +@@ -98,7 +106,7 @@ + int ret = FAIL; + + /* reset expansion variable */ +-regex_match_string = NULL; ++regex_vars_clear(); + + if (!mime_stream) /* We are in the DATA ACL */ + { +@@ -166,8 +174,7 @@ + int mime_subject_len = 0; + int ret; + +-/* reset expansion variable */ +-regex_match_string = NULL; ++regex_vars_clear(); + + /* precompile our regexes */ + if (!(re_list_head = compile(*listptr))) +--- exim-4.94.2/src/smtp_in.c 2021-04-30 14:08:21.000000000 +0200 ++++ exim-4.94.2/src/smtp_in.c 2022-10-19 09:15:58.613447975 +0200 +@@ -2161,8 +2161,10 @@ + #ifdef SUPPORT_I18N + message_smtputf8 = FALSE; + #endif ++regex_vars_clear(); + body_linecount = body_zerocount = 0; + ++lookup_value = NULL; /* Can be set by ACL */ + sender_rate = sender_rate_limit = sender_rate_period = NULL; + ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */ + /* Note that ratelimiters_conn persists across resets. */ diff --git a/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch b/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch new file mode 100644 index 000000000000..dc2f62e9ba0f --- /dev/null +++ b/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch @@ -0,0 +1,31 @@ +From 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445 Mon Sep 17 00:00:00 2001 +From: Lorenz Brun <lor...@brun.one> +Date: Fri, 14 Oct 2022 21:02:51 +0200 +Subject: [PATCH] DMARC: fix use-after-free in dmarc_dns_lookup + +This fixes a use-after-free in dmarc_dns_lookup where the result +of dns_lookup in dnsa is freed before the required data is copied out. + +Fixes: 9258363 ("DNS: explicit alloc/free of workspace") +--- + src/src/dmarc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/src/dmarc.c b/src/src/dmarc.c +index ad0c26c91..53c2752ac 100644 +--- a/src/src/dmarc.c ++++ b/src/src/dmarc.c +@@ -230,8 +230,9 @@ if (rc == DNS_SUCCEED) + rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) + if (rr->type == T_TXT && rr->size > 3) + { ++ uschar *record = string_copyn_taint(US rr->data, rr->size, GET_TAINTED); + store_free_dns_answer(dnsa); +- return string_copyn_taint(US rr->data, rr->size, GET_TAINTED); ++ return record; + } + store_free_dns_answer(dnsa); + return NULL; +-- +2.30.2 +
