From: Hongxu Jia <[email protected]> Backport a patch from upstream to fix CVE-2019-16905 https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a
Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (cherry picked from commit 8bd4b87071c073a0e4d265bc00df34684a355eff) Signed-off-by: Armin Kuster <[email protected]> --- ...x-integer-overflow-in-XMSS-private-key-pa.patch | 40 ++++++++++++++++++++++ meta/recipes-connectivity/openssh/openssh_8.0p1.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch diff --git a/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch b/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch new file mode 100644 index 0000000..3265be3 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch @@ -0,0 +1,40 @@ +From 2014fad3d28090b59d2f8a0971166c06e5fa6da6 Mon Sep 17 00:00:00 2001 +From: Hongxu Jia <[email protected]> +Date: Fri, 18 Oct 2019 14:56:58 +0800 +Subject: [PATCH] upstream: fix integer overflow in XMSS private key parsing. + +Reported by Adam Zabrocki via SecuriTeam's SSH program. + +Note that this code is experimental and not compiled by default. + +ok markus@ + +OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1 + +Signed-off-by: "[email protected]" <[email protected]> + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a] +CVE: CVE-2019-16905 + +Signed-off-by: Hongxu Jia <[email protected]> +--- + sshkey-xmss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sshkey-xmss.c b/sshkey-xmss.c +index aaae702..c57681a 100644 +--- a/sshkey-xmss.c ++++ b/sshkey-xmss.c +@@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded, + goto out; + } + /* check that an appropriate amount of auth data is present */ +- if (sshbuf_len(encoded) < encrypted_len + authlen) { ++ if (sshbuf_len(encoded) < authlen || ++ sshbuf_len(encoded) - authlen < encrypted_len) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } +-- +2.7.4 + diff --git a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb index 01eaecd..2ffbc9a 100644 --- a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb @@ -24,6 +24,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ file://sshd_check_keys \ file://add-test-support-for-busybox.patch \ + file://0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch \ " SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d" SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68" -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
