mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

socat: patch CVE-2024-54661

Browse Source 
Picked upstream commit
https://repo.or.cz/socat.git/commitdiff/4ee1f31cf80019c5907876576d6dfd49368d660f

Since this was the only commit in 1.8.0.2 it also contained release
changes which were dropped.

(From OE-Core rev: aa3187749ae9e04b91ad18be733ce09be63a50db)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2025-01-16 23:25:42 +01:00
committed by Steve Sakoman
parent 744e331d5b
commit 4bc82e0831
2 changed files with 116 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
meta/recipes-connectivity/socat/socat/CVE-2024-54661.patch Normal file
View File

@@ -0,0 +1,113 @@
From 4ee1f31cf80019c5907876576d6dfd49368d660f Mon Sep 17 00:00:00 2001
From: Gerhard Rieger <gerhard@dest-unreach.org>
Date: Fri, 6 Dec 2024 11:42:09 +0100
Subject: [PATCH] Version 1.8.0.2 - CVE-2024-54661: Arbitrary file overwrite in
readline.sh
CVE: CVE-2024-54661
Upstream-Status: Backport [https://repo.or.cz/socat.git/commitdiff/4ee1f31cf80019c5907876576d6dfd49368d660f]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
readline.sh | 10 +++++++--
test.sh | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 71 insertions(+), 2 deletions(-)
diff --git a/readline.sh b/readline.sh
index b6f8438..1045303 100755
--- a/readline.sh
+++ b/readline.sh
@@ -22,9 +22,15 @@ if [ "$withhistfile" ]; then
else
HISTOPT=
fi
-mkdir -p /tmp/$USER || exit 1
#
#
-exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>/tmp/$USER/stderr2
+if test -w .; then
+ STDERR=./socat-readline.${1##*/}.log
+ rm -f $STDERR
+else
+ STDERR=/dev/null
+fi
+
+exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>$STDERR
diff --git a/test.sh b/test.sh
index 46bebf8..5204ac7 100755
--- a/test.sh
+++ b/test.sh
@@ -15657,6 +15657,69 @@ esac
N=$((N+1))
+# Test the readline.sh file overwrite vulnerability
+NAME=READLINE_SH_OVERWRITE
+case "$TESTS" in
+*%$N%*|*%functions%*|*%bugs%*|*%readline%*|*%security%*|*%$NAME%*)
+TEST="$NAME: Test the readline.sh file overwrite vulnerability"
+# Create a symlink /tmp/$USER/stderr2 pointing to a temporary file,
+# run readline.sh
+# When the temporary file is kept the test succeeded
+if ! eval $NUMCOND; then :
+elif ! cond=$(checkconds \
+ "" \
+ "" \
+ "readline.sh" \
+ "" \
+ "" \
+ "" \
+ "" ); then
+ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
+ numCANT=$((numCANT+1))
+ listCANT="$listCANT $N"
+ namesCANT="$namesCANT $NAME"
+else
+ tf="$td/test$N.file"
+ te="$td/test$N.stderr"
+ tdiff="$td/test$N.diff"
+ da="test$N $(date) $RANDOM"
+ echo "$da" >"$tf"
+ ln -sf "$tf" /tmp/$USER/stderr2
+ CMD0="readline.sh cat"
+ printf "test $F_n $TEST... " $N
+ $CMD0 </dev/null >/dev/null 2>"${te}0"
+ rc0=$?
+# if [ "$rc0" -ne 0 ]; then
+# $PRINTF "$CANT (rc0=$rc0)\n"
+# echo "$CMD0"
+# cat "${te}0" >&2
+# numCANT=$((numCANT+1))
+# listCANT="$listCANT $N"
+# namesCANT="$namesCANT $NAME"
+# elif ! echo "$da" |diff - "$tf" >$tdiff; then
+ if ! echo "$da" |diff - "$tf" >$tdiff; then
+ $PRINTF "$FAILED (diff)\n"
+ echo "$CMD0 &"
+ cat "${te}0" >&2
+ echo "// diff:" >&2
+ cat "$tdiff" >&2
+ numFAIL=$((numFAIL+1))
+ listFAIL="$listFAIL $N"
+ namesFAIL="$namesFAIL $NAME"
+ else
+ $PRINTF "$OK\n"
+ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
+ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi
+ if [ "$VERBOSE" ]; then echo "$CMD1"; fi
+ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi
+ numOK=$((numOK+1))
+ listOK="$listOK $N"
+ fi
+fi # NUMCOND
+ ;;
+esac
+N=$((N+1))
+
# end of common tests
##################################################################################
--
2.30.2

4
meta/recipes-connectivity/socat/socat_1.7.4.4.bb
View File

@@ -9,7 +9,9 @@ LICENSE = "GPL-2.0-with-OpenSSL-exception"
LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
file://README;beginline=257;endline=287;md5=82520b052f322ac2b5b3dfdc7c7eea86"
SRC_URI = "http://www.dest-unreach.org/socat/download/socat-${PV}.tar.bz2"
SRC_URI = "http://www.dest-unreach.org/socat/download/socat-${PV}.tar.bz2 \
file://CVE-2024-54661.patch \
"
SRC_URI[sha256sum] = "fbd42bd2f0e54a3af6d01bdf15385384ab82dbc0e4f1a5e153b3e0be1b6380ac"