mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

util-linux: Fix CVE-2024-28085

Browse Source 
wall in util-linux through 2.40, often installed with setgid
tty permissions, allows escape sequences to be sent to other
users' terminals through argv. (Specifically, escape sequences
received from stdin are blocked, but escape sequences received
from argv are not blocked.) There may be plausible scenarios
where this leads to account takeover.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-28085

(From OE-Core rev: b40a77416f73955833faeddf6091a99ff9837199)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Soumya Sambu
2024-06-07 12:41:23 +00:00
committed by Steve Sakoman
parent 125ca0ff2f
commit 750ceb4b76
3 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-core/util-linux/util-linux.inc
View File

@@ -40,6 +40,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://avoid_parallel_tests.patch \
file://0001-login-utils-include-libgen.h-for-basename-API.patch \
file://fcntl-lock.c \
file://CVE-2024-28085-0001.patch \
file://CVE-2024-28085-0002.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"

36
meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0001.patch Normal file
View File

@@ -0,0 +1,36 @@
From 07f0f0f5bd1e5e2268257ae1ff6d76a9b6c6ea8b Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Wed, 17 Jan 2024 12:37:08 +0100
Subject: [PATCH] wall: fix calloc cal [-Werror=calloc-transposed-args]
term-utils/wall.c:143:37: error: xcalloc sizes specified with sizeof in the earlier argument and not in the later argument [-Werror=calloc-transposed-args]
143 | buf->groups = xcalloc(sizeof(*buf->groups), buf->ngroups);
| ^
term-utils/wall.c:143:37: note: earlier argument should specify number of elements, later size of each element
Signed-off-by: Karel Zak <kzak@redhat.com>
CVE: CVE-2024-28085
Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/07f0f0f5bd1e5e2268257ae1ff6d76a9b6c6ea8b]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
term-utils/wall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/term-utils/wall.c b/term-utils/wall.c
index 377db45..85c006a 100644
--- a/term-utils/wall.c
+++ b/term-utils/wall.c
@@ -135,7 +135,7 @@ static struct group_workspace *init_group_workspace(const char *group)
buf->requested_group = get_group_gid(group);
buf->ngroups = sysconf(_SC_NGROUPS_MAX) + 1; /* room for the primary gid */
- buf->groups = xcalloc(sizeof(*buf->groups), buf->ngroups);
+ buf->groups = xcalloc(buf->ngroups, sizeof(*buf->groups));
return buf;
}
--
2.40.0

34
meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0002.patch Normal file
View File

@@ -0,0 +1,34 @@
From 404b0781f52f7c045ca811b2dceec526408ac253 Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Thu, 21 Mar 2024 11:16:20 +0100
Subject: [PATCH] wall: fix escape sequence Injection [CVE-2024-28085]
Let's use for all cases the same output function.
Reported-by: Skyler Ferrante <sjf5462@rit.edu>
Signed-off-by: Karel Zak <kzak@redhat.com>
CVE: CVE-2024-28085
Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/404b0781f52f7c045ca811b2dceec526408ac253]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
term-utils/wall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/term-utils/wall.c b/term-utils/wall.c
index 85c006a..0212c03 100644
--- a/term-utils/wall.c
+++ b/term-utils/wall.c
@@ -328,7 +328,7 @@ static char *makemsg(char *fname, char **mvec, int mvecsz,
int i;
for (i = 0; i < mvecsz; i++) {
- fputs(mvec[i], fs);
+ fputs_careful(mvec[i], fs, '^', true, TERM_WIDTH);
if (i < mvecsz - 1)
fputc(' ', fs);
}
--
2.40.0