mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-17 20:59:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

connman: fix CVE-2022-23098

Browse Source 
An issue was discovered in the DNS proxy in Connman through 1.40.
The TCP server reply implementation has an infinite loop if no
data is received.

Backport patch from:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d8708b85c1e8fe25af7803e8a20cf20e7201d8a4

CVE: CVE-2022-23098

(From OE-Core rev: af56acf66b4196c961a20ec59faa580cc3e3ee23)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Steve Sakoman
2022-02-07 06:33:32 -10:00
committed by Richard Purdie
parent 17023dee9b
commit 9c8b420096
2 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
meta/recipes-connectivity/connman/connman/CVE-2022-23098.patch Normal file
View File

@@ -0,0 +1,50 @@
From d8708b85c1e8fe25af7803e8a20cf20e7201d8a4 Mon Sep 17 00:00:00 2001
From: Matthias Gerstner <mgerstner@suse.de>
Date: Tue, 25 Jan 2022 10:00:25 +0100
Subject: dnsproxy: Avoid 100 % busy loop in TCP server case
Once the TCP socket is connected and until the remote server is
responding (if ever) ConnMan executes a 100 % CPU loop, since
the connected socket will always be writable (G_IO_OUT).
To fix this, modify the watch after the connection is established to
remove the G_IO_OUT from the callback conditions.
Fixes: CVE-2022-23098
Upstream-Status: Backport
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d8708b85c1e8fe25af7803e8a20cf20e7201d8a4
CVE: CVE-2022-23098
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
src/dnsproxy.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/dnsproxy.c b/src/dnsproxy.c
index c027bcb9..1ccf36a9 100644
--- a/src/dnsproxy.c
+++ b/src/dnsproxy.c
@@ -2360,6 +2360,18 @@ hangup:
}
}
+ /*
+ * Remove the G_IO_OUT flag from the watch, otherwise we end
+ * up in a busy loop, because the socket is constantly writable.
+ *
+ * There seems to be no better way in g_io to do that than
+ * re-adding the watch.
+ */
+ g_source_remove(server->watch);
+ server->watch = g_io_add_watch(server->channel,
+ G_IO_IN | G_IO_HUP | G_IO_NVAL | G_IO_ERR,
+ tcp_server_event, server);
+
server->connected = true;
server_list = g_slist_append(server_list, server);
--
cgit 1.2.3-1.el7

1
meta/recipes-connectivity/connman/connman_1.37.bb
View File

@@ -10,6 +10,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
file://CVE-2021-26676-0001.patch \
file://CVE-2021-26676-0002.patch \
file://CVE-2022-23096-7.patch \
file://CVE-2022-23098.patch \
"
SRC_URI_append_libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch"