On 4/5/22 12:20, Michael Olbrich wrote: > On Wed, Mar 30, 2022 at 08:53:47PM +0200, Christian Melki wrote: >> On 3/30/22 19:48, Michael Olbrich wrote: >>> On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote: >>>> Security miss, integer overflow in the user auth path. >>>> Not exploitable due to privsep. >>>> >>>> * Update license. md5crypt removed, bcrypt relicensed. >>>> 4-Clause license removed. >>>> * Minor spelling fixes in the license file. >>>> * Remove configure option due to the removal of md5crypt. >>> >>> Fails to build here with: >>> >>> ssherr.c: In function 'ssh_err': >>> ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported >>> on this target >>> make: *** [Makefile:200: ssherr.o] Error 1 >>> >>> The stange thing is there is a configure check for it that that one >>> succeeds: >>> >>> checking if arm-v7a-linux-gnueabihf-gcc supports compile flag >>> -fzero-call-used-regs=all... yes >>> >>> Michael >>> >> >> Ack. Will look into it. Could you please tell me which gcc version >> you've used? >> I've successfully built it for an armv7-a target, but I am using 11.2. > > gcc 11.1 from OSELAS.Toolchain-2021.07.0. Or maybe this was triggered by > one of the hardening options in the platformconfig: > > PTXCONF_TARGET_HARDEN_STACK_STRONG=y > PTXCONF_TARGET_HARDEN_FORTIFY=y > PTXCONF_TARGET_HARDEN_RELRO=y > PTXCONF_TARGET_HARDEN_BINDNOW=y > PTXCONF_TARGET_HARDEN_PIE=y > PTXCONF_TARGET_HARDEN_GLIBCXX_ASSERTIONS=y > > Michael >
I have approx the same hardening enabled. It's a new function. Introduced in GCC11 I believe? Don't remember but I don't think ARM support was really that complete early on. x86_64 and aarch64 should work though. Anyway. Did the patch help? Regards, Christian >>>> Signed-off-by: Christian Melki <[email protected]> >>>> --- >>>> rules/openssh.make | 11 +++++------ >>>> 1 file changed, 5 insertions(+), 6 deletions(-) >>>> >>>> diff --git a/rules/openssh.make b/rules/openssh.make >>>> index c801d8a6a..8f48e426e 100644 >>>> --- a/rules/openssh.make >>>> +++ b/rules/openssh.make >>>> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh >>>> # >>>> # Paths and names >>>> # >>>> -OPENSSH_VERSION := 8.8p1 >>>> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453 >>>> +OPENSSH_VERSION := 8.9p1 >>>> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb >>>> OPENSSH := openssh-$(OPENSSH_VERSION) >>>> OPENSSH_SUFFIX := tar.gz >>>> OPENSSH_URL := \ >>>> @@ -25,8 +25,8 @@ OPENSSH_URL := \ >>>> >>>> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX) >>>> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH) >>>> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND >>>> BSD-4-Clause AND MIT AND Beerware AND ISC >>>> -OPENSSH_LICENSE_FILES := >>>> file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11 >>>> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND >>>> Beerware AND ISC >>>> +OPENSSH_LICENSE_FILES := >>>> file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9 >>>> >>>> # >>>> ---------------------------------------------------------------------------- >>>> # Prepare >>>> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \ >>>> --with-privsep-user=sshd \ >>>> --with-sandbox=$(OPENSSH_SANDBOX-y) \ >>>> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \ >>>> - --with-privsep-path=/var/run/sshd \ >>>> - --without-md5-passwords >>>> + --with-privsep-path=/var/run/sshd >>>> >>>> # >>>> ---------------------------------------------------------------------------- >>>> # Target-Install >>>> -- >>>> 2.32.0 >>>> >>>> >>>> _______________________________________________ >>>> ptxdist mailing list >>>> [email protected] >>>> To unsubscribe, send a mail with subject "unsubscribe" to >>>> [email protected] >>>> >>> >> >> > _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
