From: Ankur Tyagi <[email protected]> Details https://nvd.nist.gov/vuln/detail/CVE-2024-43168
Signed-off-by: Ankur Tyagi <[email protected]> --- .../unbound/unbound/CVE-2024-43168_1.patch | 29 ++++++++++ .../unbound/unbound/CVE-2024-43168_2.patch | 57 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.19.3.bb | 2 + 3 files changed, 88 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch new file mode 100644 index 0000000000..27bb01e596 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch @@ -0,0 +1,29 @@ +From ae1788088e0db0d7a31e9ef4edced212395089c1 Mon Sep 17 00:00:00 2001 +From: zhailiangliang <[email protected]> +Date: Wed, 3 Apr 2024 15:40:58 +0800 +Subject: [PATCH] fix heap-buffer-overflow issue in function cfg_mark_ports of + file util/config_file.c + +CVE: CVE-2024-43168 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/193401e7543a1e561dd634a3eaae932fa462a2b9] +(cherry picked from commit 193401e7543a1e561dd634a3eaae932fa462a2b9) +Signed-off-by: Ankur Tyagi <[email protected]> +--- + util/config_file.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/util/config_file.c b/util/config_file.c +index 147f41e8..724b174c 100644 +--- a/util/config_file.c ++++ b/util/config_file.c +@@ -1776,6 +1776,10 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num) + #endif + if(!mid) { + int port = atoi(str); ++ if(port < 0) { ++ log_err("Prevent out-of-bounds access to array avail"); ++ return 0; ++ } + if(port == 0 && strcmp(str, "0") != 0) { + log_err("cannot parse port number '%s'", str); + return 0; diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch new file mode 100644 index 0000000000..a85200a8c2 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch @@ -0,0 +1,57 @@ +From c9c49b5f3244bde6f4300fc19e56d5944fb25c0c Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" <[email protected]> +Date: Wed, 3 Apr 2024 10:16:18 +0200 +Subject: [PATCH] - For #1040: adjust error text and disallow negative ports in + other parts of cfg_mark_ports. + +CVE: CVE-2024-43168 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/dfff8d23cf4145c58e5c1e99d4159d3a91a70ab7] +(cherry picked from commit dfff8d23cf4145c58e5c1e99d4159d3a91a70ab7) +Signed-off-by: Ankur Tyagi <[email protected]> +--- + util/config_file.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/util/config_file.c b/util/config_file.c +index 724b174c..c403d745 100644 +--- a/util/config_file.c ++++ b/util/config_file.c +@@ -1777,7 +1777,7 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num) + if(!mid) { + int port = atoi(str); + if(port < 0) { +- log_err("Prevent out-of-bounds access to array avail"); ++ log_err("port number is negative: %d", port); + return 0; + } + if(port == 0 && strcmp(str, "0") != 0) { +@@ -1789,6 +1789,10 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num) + } else { + int i, low, high = atoi(mid+1); + char buf[16]; ++ if(high < 0) { ++ log_err("port number is negative: %d", high); ++ return 0; ++ } + if(high == 0 && strcmp(mid+1, "0") != 0) { + log_err("cannot parse port number '%s'", mid+1); + return 0; +@@ -1801,10 +1805,18 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num) + memcpy(buf, str, (size_t)(mid-str)); + buf[mid-str] = 0; + low = atoi(buf); ++ if(low < 0) { ++ log_err("port number is negative: %d", low); ++ return 0; ++ } + if(low == 0 && strcmp(buf, "0") != 0) { + log_err("cannot parse port number '%s'", buf); + return 0; + } ++ if(high > num) { ++ /* Stop very high values from taking a long time. */ ++ high = num; ++ } + for(i=low; i<=high; i++) { + if(i < num) + avail[i] = (allow?i:0); diff --git a/meta-networking/recipes-support/unbound/unbound_1.19.3.bb b/meta-networking/recipes-support/unbound/unbound_1.19.3.bb index 9a537c2dc2..076f03f2ae 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.19.3.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.19.3.bb @@ -14,6 +14,8 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;nobranch=1 \ file://CVE-2024-33655.patch \ file://CVE-2025-11411.patch \ file://CVE-2024-43167.patch \ + file://CVE-2024-43168_1.patch \ + file://CVE-2024-43168_2.patch \ " SRCREV = "48b6c60a24e9a5d6d369a7a37c9fe2a767f26abd"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#122683): https://lists.openembedded.org/g/openembedded-devel/message/122683 Mute This Topic: https://lists.openembedded.org/mt/116806381/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
