mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-30 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

dpkg: fix CVE-2025-6297

Browse Source 
Backport a patch from upstream to fix CVE-2025-6297 [1]

[1] https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=98c623c8d6814ae46a3b30ca22e584c77d47d86b

(From OE-Core rev: aeb49aa2bab1b6ed633922c8df24aacb6a90dcb6)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hongxu Jia
2025-07-30 14:40:03 +08:00
committed by Steve Sakoman
parent b0b4503cb8
commit 9843a3fc47
2 changed files with 131 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

130
meta/recipes-devtools/dpkg/dpkg/CVE-2025-6297.patch Normal file
View File

@@ -0,0 +1,130 @@
From 04cde8cbda7044d950488dd47321eebef4edd99f Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Sat, 7 Jun 2025 14:17:07 +0200
Subject: [PATCH] dpkg-deb: Fix cleanup for control member with restricted
directories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When extracting a control member into a temporary directory, which is
documented as being a safe operation even on untrusted data, the code
in charge of the temporary directory cleanup does not sanitize the
directory permissions, which is then unable to perform the «rm -rf»
when running as a non-root user, leaving temporary files behind.
Given automated and repeated execution of dpkg-deb commands on
adversarial .deb packages or with well compressible files, placed
inside a directory with permissions not allowing removal by a non-root
user, this can end up with a DoS scenario due to causing disk quota
exhaustion or disk full conditions.
This is considered a minor issue, given the required conditions to
trigger a problem with it, but an issue non the less given the
documented security guarantees of the command. This has been an
issue since the initial commit introducing dpkg-deb in C.
We use an existing string for the error message to avoid new strings
needing translation for stable branches, which make the error message
less descriptive than what would be ideal. This will be improved in
git HEAD.
Reported-by: zhutyra on HackerOne
Fixes: CVE-2025-6297
Stable-Candidate: 1.20.x 1.21.x 1.22.x
(cherry picked from commit ed6bbd445dd8800308c67236ba35d08004c98e82)
(cherry picked from commit 02ad0532bd490cbc95b344f670e622a38eecfbf6)
(cherry picked from commit d8a76551e22abe76eefd7fef5c7f51f4118eb40e)
Signed-off-by: Guillem Jover <guillem@debian.org>
CVE: CVE-2025-6297
Upstream-Status: Backport [https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=98c623c8d6814ae46a3b30ca22e584c77d47d86b]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
src/at/deb-content.at | 32 ++++++++++++++++++++++++++++++++
src/deb/info.c | 20 ++++++++++++++++++++
2 files changed, 52 insertions(+)
diff --git a/src/at/deb-content.at b/src/at/deb-content.at
index f475603f9..aa5582992 100644
--- a/src/at/deb-content.at
+++ b/src/at/deb-content.at
@@ -127,3 +127,35 @@ newline'
])
AT_CLEANUP
+
+AT_SETUP([dpkg-deb .deb extraction cleanup])
+AT_KEYWORDS([dpkg-deb deb extraction])
+
+DPKG_GEN_CONTROL([pkg-ctrl-dir-perms])
+AT_CHECK([
+dpkg-deb --root-owner-group -Znone -b pkg-ctrl-dir-perms
+DPKG_AR_EXTRACT([pkg-ctrl-dir-perms.deb])
+dpkg-deb -R pkg-ctrl-dir-perms.deb pkg-ctrl-dir-perms-bad
+mkdir -p pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner
+touch pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner/file
+chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN
+chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir
+chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner
+$TAR cf control.tar --format=gnu --sort=name --mtime @0 --clamp-mtime --owner root:0 --group root:0 -C pkg-ctrl-dir-perms-bad/DEBIAN .
+DPKG_AR_GEN([pkg-ctrl-dir-perms.deb], [debian-binary control.tar data.tar])
+], [0], [dpkg-deb: building package 'pkg-ctrl-dir-perms' in 'pkg-ctrl-dir-perms.deb'.
+])
+AT_CHECK([
+dpkg-deb --ctrl-tarfile pkg-ctrl-dir-perms.deb | $TAR tvf -
+], [0], [dr-xr-xr-x root/root 0 1970-01-01 00:00 ./
+-rw-r--r-- root/root 176 1970-01-01 00:00 ./control
+dr-xr-xr-x root/root 0 1970-01-01 00:00 ./rx-subdir/
+dr-xr-xr-x root/root 0 1970-01-01 00:00 ./rx-subdir/inner/
+-rw-r--r-- root/root 0 1970-01-01 00:00 ./rx-subdir/inner/file
+])
+# Check that we can cleanup the temporarily extracted control.tar member.
+AT_CHECK([
+dpkg-deb -I pkg-ctrl-dir-perms.deb
+], [0], [ignore])
+
+AT_CLEANUP
diff --git a/src/deb/info.c b/src/deb/info.c
index afe79011f..a3d566379 100644
--- a/src/deb/info.c
+++ b/src/deb/info.c
@@ -45,14 +45,34 @@
#include <dpkg/pkg-format.h>
#include <dpkg/buffer.h>
#include <dpkg/path.h>
+#include <dpkg/treewalk.h>
#include <dpkg/options.h>
#include "dpkg-deb.h"
+static int
+cu_info_treewalk_fixup_dir(struct treenode *node)
+{
+ const char *nodename;
+
+ if (!S_ISDIR(treenode_get_mode(node)))
+ return 0;
+
+ nodename = treenode_get_pathname(node);
+ if (chmod(nodename, 0755) < 0)
+ ohshite(_("error setting permissions of '%.255s'"), nodename);
+
+ return 0;
+}
+
static void cu_info_prepare(int argc, void **argv) {
char *dir;
+ struct treewalk_funcs cu_info_treewalk_funcs = {
+ .visit = cu_info_treewalk_fixup_dir,
+ };
dir = argv[0];
+ treewalk(dir, TREEWALK_NONE, &cu_info_treewalk_funcs);
path_remove_tree(dir);
free(dir);
}
--
2.49.0

1
meta/recipes-devtools/dpkg/dpkg_1.22.11.bb
View File

@@ -13,6 +13,7 @@ SRC_URI = "git://salsa.debian.org/dpkg-team/dpkg.git;protocol=https;branch=main
file://0007-dpkg-deb-build.c-Remove-usage-of-clamp-mtime-in-tar.patch \
file://0001-dpkg-Support-muslx32-build.patch \
file://0001-Add-support-for-riscv32-CPU.patch \
file://CVE-2025-6297.patch \
"
SRC_URI:append:class-native = " file://0001-build.c-ignore-return-of-1-from-tar-cf.patch"