On Thu, Nov 24, 2022 at 2:25 AM vkumbhar <[email protected]> wrote: > > From: Vivek Kumbhar <[email protected]> > > Upstream-Status: Backport from > https://github.com/python/cpython/commit/eae692eed18892309bcc25a2c0f8980038305ea2 > > Signed-off-by: Vivek Kumbhar <[email protected]> > --- > .../python/python3/CVE-2022-42919.patch | 70 +++++++++++++++++++ > .../recipes-devtools/python/python3_3.10.7.bb | 1 +
Dunfell python version is 3.8.14, so this patch will not apply. This seems to be the same as the patch you sent for kirkstone. Was this sent in error? Steve > 2 files changed, 71 insertions(+) > create mode 100644 meta/recipes-devtools/python/python3/CVE-2022-42919.patch > > diff --git a/meta/recipes-devtools/python/python3/CVE-2022-42919.patch > b/meta/recipes-devtools/python/python3/CVE-2022-42919.patch > new file mode 100644 > index 0000000000..6040724dae > --- /dev/null > +++ b/meta/recipes-devtools/python/python3/CVE-2022-42919.patch > @@ -0,0 +1,70 @@ > +From 87ef80926ea0ec960a220af89d8ff4db99417b03 Mon Sep 17 00:00:00 2001 > +From: Vivek Kumbhar <[email protected]> > +Date: Thu, 24 Nov 2022 17:44:18 +0530 > +Subject: [PATCH] CVE-2022-42919 > + > +Upstream-Status: Backport > [https://github.com/python/cpython/commit/eae692eed18892309bcc25a2c0f8980038305ea2] > +CVE: CVE-2022-42919 > +Signed-off-by: Vivek Kumbhar <[email protected]> > + > +[3.10] gh-97514: Don't use Linux abstract sockets for multiprocessing > (GH-98501) (GH-98503) > + > +Linux abstract sockets are insecure as they lack any form of filesystem > +permissions so their use allows anyone on the system to inject code into > +the process. > + > +This removes the default preference for abstract sockets in > +multiprocessing introduced in Python 3.9+ via > +https://github.com/python/cpython/pull/18866 while fixing > +https://github.com/python/cpython/issues/84031. > + > +Explicit use of an abstract socket by a user now generates a > +RuntimeWarning. If we choose to keep this warning, it should be > +backported to the 3.7 and 3.8 branches. > +(cherry picked from commit 49f61068f49747164988ffc5a442d2a63874fc17) > +--- > + Lib/multiprocessing/connection.py | 5 ----- > + .../2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst | 15 +++++++++++++++ > + 2 files changed, 15 insertions(+), 5 deletions(-) > + create mode 100644 > Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst > + > +diff --git a/Lib/multiprocessing/connection.py > b/Lib/multiprocessing/connection.py > +index 510e4b5..8e2facf 100644 > +--- a/Lib/multiprocessing/connection.py > ++++ b/Lib/multiprocessing/connection.py > +@@ -73,11 +73,6 @@ def arbitrary_address(family): > + if family == 'AF_INET': > + return ('localhost', 0) > + elif family == 'AF_UNIX': > +- # Prefer abstract sockets if possible to avoid problems with the > address > +- # size. When coding portable applications, some implementations > have > +- # sun_path as short as 92 bytes in the sockaddr_un struct. > +- if util.abstract_sockets_supported: > +- return f"\0listener-{os.getpid()}-{next(_mmap_counter)}" > + return tempfile.mktemp(prefix='listener-', dir=util.get_temp_dir()) > + elif family == 'AF_PIPE': > + return tempfile.mktemp(prefix=r'\\.\pipe\pyc-%d-%d-' % > +diff --git > a/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst > b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst > +new file mode 100644 > +index 0000000..02d95b5 > +--- /dev/null > ++++ b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst > +@@ -0,0 +1,15 @@ > ++On Linux the :mod:`multiprocessing` module returns to using filesystem > backed > ++unix domain sockets for communication with the *forkserver* process instead > of > ++the Linux abstract socket namespace. Only code that chooses to use the > ++:ref:`"forkserver" start method <multiprocessing-start-methods>` is > affected. > ++ > ++Abstract sockets have no permissions and could allow any user on the system > in > ++the same `network namespace > ++<https://man7.org/linux/man-pages/man7/network_namespaces.7.html>`_ (often > the > ++whole system) to inject code into the multiprocessing *forkserver* process. > ++This was a potential privilege escalation. Filesystem based socket > permissions > ++restrict this to the *forkserver* process user as was the default in Python > 3.8 > ++and earlier. > ++ > ++This prevents Linux `CVE-2022-42919 > ++<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919>`_. > +-- > +2.25.1 > + > diff --git a/meta/recipes-devtools/python/python3_3.10.7.bb > b/meta/recipes-devtools/python/python3_3.10.7.bb > index 404a582135..2d230793ef 100644 > --- a/meta/recipes-devtools/python/python3_3.10.7.bb > +++ b/meta/recipes-devtools/python/python3_3.10.7.bb > @@ -35,6 +35,7 @@ SRC_URI = > "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ > > file://0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch \ > file://deterministic_imports.patch \ > file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ > + file://CVE-2022-42919.patch \ > " > > SRC_URI:append:class-native = " \ > -- > 2.25.1 > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#173778): https://lists.openembedded.org/g/openembedded-core/message/173778 Mute This Topic: https://lists.openembedded.org/mt/95236618/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
