On Thu, 5 Oct 2023, Steve Sakoman wrote:

> Hmmm ... does this build for you?
>
> I'm getting:
>
> ERROR: glibc-2.31+gitAUTOINC+2d4f26e5cf-r0 do_patch: Applying patch
> 'CVE-2023-4911.patch' on target directory
> '/home/steve/builds/poky-contrib/build/tmp/work/core2-64-poky-linux/glibc/2.31+gitAUTOINC+2d4f26e5cf-r0/git'
> Command Error: 'quilt --quiltrc
> /home/steve/builds/poky-contrib/build/tmp/work/core2-64-poky-linux/glibc/2.31+gitAUTOINC+2d4f26e5cf-r0/recipe-sysroot-native/etc/quiltrc
> push' exited with 0  Output:
> Applying patch CVE-2023-4911.patch
> patching file elf/dl-tunables.c
> Hunk #1 FAILED at 187.
> Hunk #2 FAILED at 251.
> 2 out of 2 hunks FAILED -- rejects in file elf/dl-tunables.c
> Patch CVE-2023-4911.patch does not apply (enforce with -f)
>
> Steve

Debian's page at https://security-tracker.debian.org/tracker/CVE-2023-4911
indicates at the bottom that they're only vulnerable on their 2.31 based
versions because they backported the change that introduced the
vulnerability, which I don't believe has been done in oe-core...

Scott

> On Wed, Oct 4, 2023 at 10:54 PM Mike Crowe via lists.openembedded.org
> <[email protected]> wrote:
> >
> > From: Mike Crowe <[email protected]>
> >
> > Take the patch from the source for Debian's glibc 2.31-13+deb11u7
> > package, the changelog for which starts with:
> >
> >  glibc (2.31-13+deb11u7) bullseye-security; urgency=medium
> >
> >    * debian/patches/any/local-CVE-2023-4911.patch: Fix a buffer overflow in 
> > the
> >      dynamic loader's processing of the GLIBC_TUNABLES environment variable
> >      (CVE-2023-4911).
> >
> > This addresses the "Looney Tunables" vulnerability described at
> > https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
> >
> > Signed-off-by: Mike Crowe <[email protected]>
> > ---
> >  .../glibc/glibc/CVE-2023-4911.patch           | 63 +++++++++++++++++++
> >  meta/recipes-core/glibc/glibc_2.31.bb         |  1 +
> >  2 files changed, 64 insertions(+)
> >  create mode 100644 meta/recipes-core/glibc/glibc/CVE-2023-4911.patch
> >
> > diff --git a/meta/recipes-core/glibc/glibc/CVE-2023-4911.patch 
> > b/meta/recipes-core/glibc/glibc/CVE-2023-4911.patch
> > new file mode 100644
> > index 0000000000..4d3146509a
> > --- /dev/null
> > +++ b/meta/recipes-core/glibc/glibc/CVE-2023-4911.patch
> > @@ -0,0 +1,63 @@
> > +From d2b77337f734fcacdfc8e0ddec14cf31a746c7be Mon Sep 17 00:00:00 2001
> > +From: Siddhesh Poyarekar <[email protected]>
> > +Date: Mon, 11 Sep 2023 18:53:15 -0400
> > +Subject: [PATCH v2] tunables: Terminate immediately if end of input is 
> > reached
> > +
> > +The string parsing routine may end up writing beyond bounds of tunestr
> > +if the input tunable string is malformed, of the form name=name=val.
> > +This gets processed twice, first as name=name=val and next as name=val,
> > +resulting in tunestr being name=name=val:name=val, thus overflowing
> > +tunestr.
> > +
> > +Terminate the parsing loop at the first instance itself so that tunestr
> > +does not overflow.
> > +---
> > +Changes from v1:
> > +
> > +- Also null-terminate tunestr before exiting.
> > +
> > + elf/dl-tunables.c | 17 ++++++++++-------
> > + 1 file changed, 10 insertions(+), 7 deletions(-)
> > +
> > +Upstream-Status: Backport [git://sourceware.org/git/glibc.git]
> > +CVE: CVE-2023-4911
> > +
> > +diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
> > +index 8e7ee9df10..76cf8b9da3 100644
> > +--- a/elf/dl-tunables.c
> > ++++ b/elf/dl-tunables.c
> > +@@ -187,11 +187,7 @@ parse_tunables (char *tunestr, char *valstring)
> > +       /* If we reach the end of the string before getting a valid 
> > name-value
> > +        pair, bail out.  */
> > +       if (p[len] == '\0')
> > +-      {
> > +-        if (__libc_enable_secure)
> > +-          tunestr[off] = '\0';
> > +-        return;
> > +-      }
> > ++      break;
> > +
> > +       /* We did not find a valid name-value pair before encountering the
> > +        colon.  */
> > +@@ -251,9 +247,16 @@ parse_tunables (char *tunestr, char *valstring)
> > +           }
> > +       }
> > +
> > +-      if (p[len] != '\0')
> > +-      p += len + 1;
> > ++      /* We reached the end while processing the tunable string.  */
> > ++      if (p[len] == '\0')
> > ++      break;
> > ++
> > ++      p += len + 1;
> > +     }
> > ++
> > ++  /* Terminate tunestr before we leave.  */
> > ++  if (__libc_enable_secure)
> > ++    tunestr[off] = '\0';
> > + }
> > + #endif
> > +
> > +--
> > +2.41.0
> > +
> > diff --git a/meta/recipes-core/glibc/glibc_2.31.bb 
> > b/meta/recipes-core/glibc/glibc_2.31.bb
> > index 8d216f6ed1..1862586749 100644
> > --- a/meta/recipes-core/glibc/glibc_2.31.bb
> > +++ b/meta/recipes-core/glibc/glibc_2.31.bb
> > @@ -80,6 +80,7 @@ SRC_URI =  
> > "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
> >             
> > file://0036-i386-Avoid-lazy-relocation-of-tlsdesc-BZ-27137.patch \
> >             
> > file://0037-Avoid-deadlock-between-pthread_create-and-ctors.patch \
> >             file://CVE-2023-0687.patch \
> > +           file://CVE-2023-4911.patch \
> >             "
> >  S = "${WORKDIR}/git"
> >  B = "${WORKDIR}/build-${TARGET_SYS}"
> > --
> > 2.39.2
> >
> > BrightSign considers your privacy to be very important. The emails you send 
> > to us will be protected and secured. Furthermore, we will only use your 
> > email and contact information for the reasons you sent them to us and for 
> > tracking how effectively we respond to your requests.
> >
> >
> >
>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188723): 
https://lists.openembedded.org/g/openembedded-core/message/188723
Mute This Topic: https://lists.openembedded.org/mt/101773057/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to