Commit Graph

50458 Commits

Author SHA1 Message Date
Khem Raj
d4234f8a2f serf: Fix Sconstruct build with python 3.7
These patches will be needed to build serf on hosts with
python 3.7+

(From OE-Core rev: ab0be544b392bbd6cb1dc91edd5fe8563d7de393)

(From OE-Core rev: ffe1795dc6daf9999e1be858a4e97a4c2cf44526)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Changqing Li
d759a0659b libice: patch for CVE-2017-2626
(From OE-Core rev: 890093056ccff294364cc768bd797cb54fcbcee3)

(From OE-Core rev: 52d3c4c644807a8fe3badc5aa025c1d48ec67c16)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Yi Zhao
337e750c40 taglib: Security fix CVE-2018-11439
CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function in
oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause
information disclosure (heap-based buffer over-read) via a crafted audio
file.

References:
https://nvd.nist.gov/vuln/detail/CVE-2018-11439

Patch from:
272648ccfc

(From OE-Core rev: a300c4917b6c22ef039158be7ae92055c35658d4)

(From OE-Core rev: 4b4c663fe048be7e7c39addb022a7ae471c743de)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Armin Kuster
15fe03a352 xserver-xorg: config: fix NULL value detection for ID_INPUT being unset
Fixes Yocto # 12899

Xorg.log message:

(II) config/udev: Adding input device (unnamed) (/dev/tty59)

and cause system freezes.

(From OE-Core rev: e29a330e04baf0881805e4a36d28bafad7fcd318)

(From OE-Core rev: b5fb3a7c5c873747eaa028d588a22a1ca1956544)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Changqing Li
a8fd685dfb libid3tag: patch for CVE-2004-2779
(From OE-Core rev: e2bec1f7e05ec014bd887440521da7e1a13555be)

(From OE-Core rev: 86be219d43a72f4786bda25e8c544925b42f3a2f)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Changqing Li
d3e6b9e6f4 libcroco: patch for CVE-2017-7960
(From OE-Core rev: 2539d7334cbe9693ebe68d33c7a97872a1645510)

(From OE-Core rev: 3abf7932e43115cc6f9a1c85a00e6578bb327b9a)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Changqing Li
6a1b1ea620 squashfs-tools: patch for CVE-2015-4645(4646)
(From OE-Core rev: 8aa8bc77ef311b1c9dffcd2e2c0da610697b89fd)

(From OE-Core rev: cf3b59c3466d45ce4451dc8d775350e4762fe6d1)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Changqing Li
b0c32939f2 libexif: patch for CVE-2017-7544
(From OE-Core rev: b25f5e8efbe723520fa6e6311767c35e4cb71859)

(From OE-Core rev: 221e5fca3aa222e67fb6af248a99b2d0f0d1f6a0)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Mike Looijmans
6af1b257ed busybox/mdev-mount.sh: Fix partition detect and cleanup mountpoint on fail
This fixes issues mainly seen when mounting eMMC devices:

The wildcard /sys/block/${DEVBASE}/${DEVBASE}*1 matches both "mmcblk0p1"
and "mmcblk0boot1" for example, and this results in syntax errors. Fix this
by searching for a "partition" file instead, which only exists for real
partitions and not 'fakes' like the eMMC extra's.

When mount fails, the mountpoint file is left behind, causing later attempts
at auto-mounting it to fail. If mount fails, remove the mountpoint, leaving
the system in the state as it was before the mount attempt.

(From OE-Core rev: 8645c0419456c1bd3ae15a9a7dd2b2e9a960eaf4)

(From OE-Core rev: 38f1648f1472f70a3e747f270cc3230b5993d94b)

Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Chen Qi
7da5ae7927 busybox: move init related configs to init.cfg
Move init related configs to init.cfg.

These config items do not make much sense unless busybox is selected
as the init manager. They should belong to init.cfg.

(From OE-Core rev: 4af10fe67a31368163bb5d468ee2c5a85ce0fff3)

(From OE-Core rev: 996247ba7dfffbeb444f793f7e105fcfb5ffa939)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Yadi.hu
63eae5751e busybox: handle syslog
If CONFIG_KLOGD is not enabled, then the related service file should
not be installed, The error message is below:

    Cannot add dependency job for unit busybox-klogd.service,
    ignoring: Unit busybox-klogd.service failed to load:
    No such file or directory.

So we should first check the configuration before we install these
service files.

(From OE-Core rev: c3cc402df996654bf6f838b1e79e16a8bdd6d4d7)

(From OE-Core rev: df1cd90140456dbed0c1bd29ead7c1c81f498b99)

Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Yi Zhao
9afe31b30c blktrace: Security fix CVE-2018-10689
CVE-2018-10689: blktrace (aka Block IO Tracing) 1.2.0, as used with the
Linux kernel and Android, has a buffer overflow in the dev_map_read
function in btt/devmap.c because the device and devno arrays are too
small, as demonstrated by an invalid free when using the btt program
with a crafted file.

References:
https://nvd.nist.gov/vuln/detail/CVE-2018-10689

Patch from:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7

(From OE-Core rev: 6a7ed8b1db10abd38bdd20c77a8f27427d381156)

(From OE-Core rev: 54b26752149d945955569f163bf9dd1595970d35)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Chen Qi
28c68772cb util-linux: upgrade 2.32 -> 2.32.1
(From OE-Core rev: 711f867b1d036aba04e839e955e0fa9d81d3c794)

(From OE-Core rev: a925096c62b2034c824bfdf68631e037809b6a30)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Bug fix update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-27 12:17:45 +01:00
Karsten Strand
51872d3f99 bitbake: bitbake: toaster: Fix comparison in recipe template
Use == instead of = when comparing task outcome to OUTCOME_FAILED.

Prior to this fix the recipe template would cause a TemplateSyntaxError
exception.

(Bitbake rev: a53ffec4ed3d0f9221bca398e20e8f480fb2b325)

(Bitbake rev: bef6ef1a79b2d5a3688ae845824f722c332d7f19)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
73c29f321a bitbake: toaster/layerdetails.js: don't hide local layer info
The local layer info (provided through custom fixtures) should
not be hidden. It is better to handle it in the same manner
as an imported layer, otherwise the layer path and dependency
info is not shown. The layer editing fields are handled in the
html side of things appropriately so this does not harm that
implementation.

[YOCTO #12891]

(Bitbake rev: 75918405346abde6055658372c1a954a214001cc)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
0b15ee38ad bitbake: toaster/models.py: allow local paths for custom recipe's base
In a case where the layer source is local only and the recipe
is not yet built, we can search for the path with layer's
local_source_dir, and if available that should be used rather
than just skipping the scenario.

[YOCTO #12891]

(Bitbake rev: 30f622dbd874b800c5bbdbeac992dd7783092928)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
1ba6706ce2 bitbake: toaster/checksettings: allow CUSTOM_XML_ONLY setting through env
This change allows the CUSTOM_XML_ONLY toaster setting to be
provided through the environment so the user can do this without
mingling with the settings.xml, for scenarios where modifying
settings.xml is not achievable.

[YOCTO #12891]

(Bitbake rev: 87060a84e74125be10db062da3032e9b01f5dc96)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
e4c6642adc bitbake: toastergui/newproject.html: fix release divs
The release drop down divs are not being closed
appropriately, which showed adverse reactions on
the UI that aligned the "Create project" button
with the left edge of the screen without any
margins. This fixes these divs which in turn
aligns the button appropriately.

[YOCTO #12891]

(Bitbake rev: bc6a137f4f8193cadfa8a8d0e43875991d47a818)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
61428c05bb bitbake: toaster/widgets.py: avoid divide by zero issues
There can be cases where the variables being used
to divide in build percentage expressions can be
zero. For example, a setup consisting of only local
repos will have repos_to_clone=0 and will generate
a divide by zero scenario.
Fix this by checking the divisor in such cases.

[YOCTO #12891]

(Bitbake rev: 30702f29928c3b088f199bf8b1609b2956f8c47a)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
90a9b1b0f5 bitbake: bitbake: toaster: allow TOASTER_DIR to be overridden from cmdline
TOASTER_DIR is used for higher level toaster artifacts
such the SQL DB and creating toaster internal build
directories for projects. Prior to this change it was
evaluated as `dirname $BUILDDIR` and user had no control
over it. This change allows to override this variable
from the command line for more flexibility. The variable
defaults to its original setting if the optional argument
is not passed.

[YOCTO #12891]

(Bitbake rev: e073775d3b6980fc8004ae28a3ccc3c5bbf50fb2)

(Bitbake rev: 486e571b1caaf7f86f8f969c512566487bcd9841)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
c1f5ec8f43 bitbake: toaster: use a more flexible way to find bitbake
The current mechanism for finding the bitbake binary
assumes a directory structure which is identical to
poky, where oe-core's meta and bitbake directories are
at the same level. There can be a case where bitbake
is used from elsewhere and in such cases the above
mentioned assumption fails to hold, whereas this is
totally allowed by the oe-init-build-env script which
can take bitbakedir as an argument.
The better approach is to allow bitbake to be derived
from PATH, while keeping the older mechanism in place so
it can be removed after tests are done in various
environments. This makes more sense as toaster has
also been launched from the same bitbake instance
that is the one in PATH.

[YOCTO #12891]

(Bitbake rev: 15340edce23e63b060c75114d508e1f76757239c)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Awais Belal
e44bb5b5c8 bitbake: toaster: allow pokydirname to be evaluated when all layers are local
Toaster depends on pokydirname for identifying the location of
the oe-init-build-env script (and there might be other purposes
in the future). The problem with current approach is that it
only checks/sets the variable with git based repos, whereas
toaster provides mechanisms to allow having layers that are all
locally available. The evaluation of the variable fails in such
scenarios, so use a more flexible mechanism in this case and
try to locate poky in the local layers as well, if not already
set.

[YOCTO #12891]

(Bitbake rev: 971c728075af05e71edfd8e5212728c3dd0787b6)

Signed-off-by: Awais Belal <awais.belal@mentor.com>
Signed-off-by: David Reyna <David.Reyna@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-10 12:15:04 +01:00
Ross Burton
45ef387cc5 bitbake: checksum: sanity check path when recursively checksumming
In case something goes tragically wrong, catch a request to checksum / and
refuse.

(Bitbake rev: 7444419b7fda34e14d653ba8470f5dfabb5da4f3)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Ross Burton
ee176ddba8 bitbake: utils/md5_file: don't iterate line-by-line
Opening a file in binary mode and iterating it seems like the simple solution
but will still break on newlines, which for binary files isn't really useful as
the size of the chunks could be huge or tiny.

Instead, let's be a bit more clever: we'll be MD5ing lots of files, but we don't
want to fill up memory: use mmap() to open the file and read the file in 8k
blocks.

(Bitbake rev: 41e6161c8ce8cc90ebc93d72852673ae60fac923)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Joshua Watt
8f7fb9baf8 swig: Remove superfluous python dependency
The actual dependency on native Python and is handled by inheriting
python3native

(From OE-Core rev: 115a6dea664c9b18fd19b79659029afb52b1a660)

(From OE-Core rev: 82b018956763bf85b90d512c8a6bc96d59fa67fd)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Hongxu Jia
63a0057efb patch: fix CVE-2018-6952
(From OE-Core rev: 1314a6953aa647706107557faaba8574e307d2bd)

(From OE-Core rev: 100d7f19b7075b54dcc60f07ef8159e0e4f5be8c)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
90cb0ee1c2 perl: CVE-2018-12015
Remove existing files before overwriting them

Archive should extract only the latest same-named entry.
Extracted regular file should not be writtent into existing block
device (or any other one).

https://rt.cpan.org/Ticket/Display.html?id=125523

Affects perl <= 5.26.2

(From OE-Core rev: ca005cd857f8e79b135c43526d5b792478a07eb3)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
4f6ff3e60c perl: CVE-2018-6913
(perl #131844) fix various space calculation issues in
 pp_pack.c

- for the originally reported case, if the start/cur pointer is in the
  top 75% of the address space the add (cur) + glen addition would
  overflow, resulting in the condition failing incorrectly.

- the addition of the existing space used to the space needed could
  overflow, resulting in too small an allocation and a buffer overflow.

- the scaling for UTF8 could overflow.

- the multiply to calculate the space needed for many items could
  overflow.

For the first case, do a space calculation without making new pointers.

For the other cases, detect the overflow and croak if there's an
overflow.

Originally this used Size_t_MAX as the maximum size of a memory
allocation, but for -DDEBUGGING builds realloc() throws a panic for
allocations over half the address space in size, changing the error
reported for the allocation.

For non-DEBUGGING builds the Size_t_MAX limit has the small chance
of finding a system that has 3GB of contiguous space available, and
allocating that space, which could be a denial of servce in some cases.

Unfortunately changing the limit to half the address space means that
the exact case with the original issue can no longer occur, so the
test is no longer testing against the address + length issue that
caused the original problem, since the allocation is failing earlier.

One option would be to change the test so the size request by pack is
just under 2GB, but this has a higher (but still low) probability that
the system has the address space available, and will actually try to
allocate the memory, so let's not do that.

Note: changed
plan tests => 14713;
to
plan tests => 14712;
in a/t/op/pack.t
to apply this patch on perl 5.24.1.

Affects perl < 5.26.2

(From OE-Core rev: 0542779d2f1a8977a732800a8998fd88971c0c1d)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
69728984e3 perl: CVE-2018-6797
(perl #132227) restart a node if we change to uni rules within the node and encounter...
This could lead to a buffer overflow.

(cherry picked from commit a02c70e35d1313a5f4e245e8f863c810e991172d)

Affects perl >= 5.18 && perl <= 5.26

(From OE-Core rev: 109ffd1b3d10753bfd711a14ad59b194ca3ce831)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
7273f1183f perl: CVE-2018-6798
* CVE-2018-6798-1
 The proximal cause is several instances in regexec.c of the code
 assuming that the input was valid UTF-8, whereas the input was too short
 for what the start byte claimed it would be.

 I grepped through the core for any other similar uses, and did not find
 any.

 (cherry picked from commit fe7d8ba0a1bf567af8fa8fea128e2b9f4c553e84)

* CVE-2018-6798-2
 The first patch for 132063 prevented the buffer read overflow when
 dumping the warning but didn't fix the underlying problem.

 The next change treats the supplied buffer correctly, preventing the
 non-UTF-8 SV from being treated as UTF-8, preventing the warning.

 (cherry picked from commit 1e8b61488f195e1396aa801c685340b156104f4f)

Affects perl >= 5.22 && perl <= 5.26

(From OE-Core rev: 4aaf09b9d657b1c2df85bf509008beacd6a00342)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
d82d8d4315 qemu: CVE-2018-12617
qga: check bytes count read by guest-file-read

While reading file content via 'guest-file-read' command,
'qmp_guest_file_read' routine allocates buffer of count+1
bytes. It could overflow for large values of 'count'.
Add check to avoid it.

Affects qemu < v3.0.0

(From OE-Core rev: a11c8ee86007f7f7a34b9dc29d01acc323b71873)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
2ef1650794 qemu: CVE-2018-7550
multiboot: bss_end_addr can be zero

The multiboot spec
(https://www.gnu.org/software/grub/manual/multiboot/),
section 3.1.3, allows for bss_end_addr to be zero.

A zero bss_end_addr signifies there is no .bss section.

Affects qemu < v2.12.0

(From OE-Core rev: 9f1d026168956e7bf45135577c123f7679a6ebba)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
46d4ce537d python: CVE-2018-1000030
* CVE-2018-1000030-1
[2.7] bpo-31530: Stop crashes when iterating over a file on multiple threads

* CVE-2018-1000030-2
Multiple threads iterating over a file can corrupt the file's internal readahead
buffer resulting in crashes. To fix this, cache buffer state thread-locally for
the duration of a file_iternext call and only update the file's internal state
after reading completes.

No attempt is made to define or provide "reasonable" semantics for iterating
over a file on multiple threads. (Non-crashing) races are still
present. Duplicated, corrupt, and missing data will happen.

This was originally fixed by 6401e56, which
raised an exception from seek() and next() when concurrent operations were
detected. Alas, this simpler solution breaks legitimate use cases such as
capturing the standard streams when multiple threads are logging.

Affects python <= 2.7.14

(From OE-Core rev: 4b6c84e0f950f839bfb8c40f197197f838d8b733)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
ac9770edca procps: CVE-2018-1124
proc/readproc.c: Fix bugs and overflows in file2strvec().

Note: this is by far the most important and complex patch of the whole
series, please review it carefully; thank you very much!

For this patch, we decided to keep the original function's design and
skeleton, to avoid regressions and behavior changes, while fixing the
various bugs and overflows. And like the "Harden file2str()" patch, this
patch does not fail when about to overflow, but truncates instead: there
is information available about this process, so return it to the caller;
also, we used INT_MAX as a limit, but a lower limit could be used.

The easy changes:

- Replace sprintf() with snprintf() (and check for truncation).

- Replace "if (n == 0 && rbuf == 0)" with "if (n <= 0 && tot <= 0)" and
  do break instead of return: it simplifies the code (only one place to
  handle errors), and also guarantees that in the while loop either n or
  tot is > 0 (or both), even if n is reset to 0 when about to overflow.

- Remove the "if (n < 0)" block in the while loop: it is (and was) dead
  code, since we enter the while loop only if n >= 0.

- Rewrite the missing-null-terminator detection: in the original
  function, if the size of the file is a multiple of 2047, a null-
  terminator is appended even if the file is already null-terminated.

- Replace "if (n <= 0 && !end_of_file)" with "if (n < 0 || tot <= 0)":
  originally, it was equivalent to "if (n < 0)", but we added "tot <= 0"
  to handle the first break of the while loop, and to guarantee that in
  the rest of the function tot is > 0.

- Double-force ("belt and suspenders") the null-termination of rbuf:
  this is (and was) essential to the correctness of the function.

- Replace the final "while" loop with a "for" loop that behaves just
  like the preceding "for" loop: in the original function, this would
  lead to unexpected results (for example, if rbuf is |\0|A|\0|, this
  would return the array {"",NULL} but should return {"","A",NULL}; and
  if rbuf is |A|\0|B| (should never happen because rbuf should be null-
  terminated), this would make room for two pointers in ret, but would
  write three pointers to ret).

The hard changes:

- Prevent the integer overflow of tot in the while loop, but unlike
  file2str(), file2strvec() cannot let tot grow until it almost reaches
  INT_MAX, because it needs more space for the pointers: this is why we
  introduced ARG_LEN, which also guarantees that we can add "align" and
  a few sizeof(char*)s to tot without overflowing.

- Prevent the integer overflow of "tot + c + align": when INT_MAX is
  (almost) reached, we write the maximal safe amount of pointers to ret
  (ARG_LEN guarantees that there is always space for *ret = rbuf and the
  NULL terminator).

Affects procps-ng < 3.3.15

(From OE-Core rev: 82d873a1b73da25ae415afe0e6203693f78b88c9)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
f183e88d06 shadow: CVE-2018-7169
newgidmap: enforce setgroups=deny if self-mapping a group

This is necessary to match the kernel-side policy of "self-mapping in a
user namespace is fine, but you cannot drop groups" -- a policy that was
created in order to stop user namespaces from allowing trivial privilege
escalation by dropping supplementary groups that were "blacklisted" from
certain paths.

This is the simplest fix for the underlying issue, and effectively makes
it so that unless a user has a valid mapping set in /etc/subgid (which
only administrators can modify) -- and they are currently trying to use
that mapping -- then /proc/$pid/setgroups will be set to deny. This
workaround is only partial, because ideally it should be possible to set
an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
administrators to further restrict newgidmap(1).

We also don't write anything in the "allow" case because "allow" is the
default, and users may have already written "deny" even if they
technically are allowed to use setgroups. And we don't write anything if
the setgroups policy is already "deny".

Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
Fixes: CVE-2018-7169

Affects shadow <= 4.5

(From OE-Core rev: a875522540372a4fa6658885692e564dfd729f54)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
8fcd5a31b9 gnupg: CVE-2018-12020
gpg: Sanitize diagnostic with the original file name.

* g10/mainproc.c (proc_plaintext): Sanitize verbose output.

(From OE-Core rev: f1c0da2bcb0587ac25176db11365d4a2a15b3d30)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
52fc5763c6 git: CVE-2018-11235
submodule-config: verify submodule names as paths

Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).

Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:

  1. What should the allowed syntax be?

     It's tempting to reuse verify_path(), since submodule
     names typically come from in-repo paths. But there are
     two reasons not to:

       a. It's technically more strict than what we need, as
          we really care only about breaking out of the
          $GIT_DIR/modules/ hierarchy.  E.g., having a
          submodule named "foo/.git" isn't actually
          dangerous, and it's possible that somebody has
          manually given such a funny name.

       b. Since we'll eventually use this checking logic in
          fsck to prevent downstream repositories, it should
          be consistent across platforms. Because
          verify_path() relies on is_dir_sep(), it wouldn't
          block "foo\..\bar" on a non-Windows machine.

  2. Where should we enforce it? These days most of the
     .gitmodules reads go through submodule-config.c, so
     I've put it there in the reading step. That should
     cover all of the C code.

     We also construct the name for "git submodule add"
     inside the git-submodule.sh script. This is probably
     not a big deal for security since the name is coming
     from the user anyway, but it would be polite to remind
     them if the name they pick is invalid (and we need to
     expose the name-checker to the shell anyway for our
     test scripts).

     This patch issues a warning when reading .gitmodules
     and just ignores the related config entry completely.
     This will generally end up producing a sensible error,
     as it works the same as a .gitmodules file which is
     missing a submodule entry (so "submodule update" will
     barf, but "git clone --recurse-submodules" will print
     an error but not abort the clone.

     There is one minor oddity, which is that we print the
     warning once per malformed config key (since that's how
     the config subsystem gives us the entries). So in the
     new test, for example, the user would see three
     warnings. That's OK, since the intent is that this case
     should never come up outside of malicious repositories
     (and then it might even benefit the user to see the
     message multiple times).

Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.

Affects: git < 2.13.7 and  git < 2.14.4 and git < 2.15.2 and git < 2.16.4 and
         git < 2.17.1

(From OE-Core rev: 229bb7cd70c79944d54696d50f4f34df85a5804a)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
dfe237a93b libgcrypt: CVE-2018-0495
ecc: Add blinding for ECDSA.

* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Blind secret D with
randomized nonce B.

(From OE-Core rev: e05c9b1be8e852293dfc7026f0e3178c3bc5444d)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
a4ce8dbcc6 coreutils: CVE-2017-18018
CVE-2017-18018-1:
doc: clarify chown/chgrp --dereference defaults
* doc/coreutils.texi: the documentation for the --dereference
  flag of chown/chgrp states that it is the default mode of
  operation. Document that this is only the case when operating
  non-recursively.

CVE-2017-18018-2:
doc: warn about following symlinks recursively in chown/chgrp
In both chown and chgrp (which shares its code with chown), operating
on symlinks recursively has a window of vulnerability where the
destination user or group can change the target of the operation.
Warn about combining the --dereference, --recursive, and -L flags.

* doc/coreutils.texi (warnOptDerefWithRec): Add macro.
(node chown invocation): Add it to --dereference and -L.
(node chgrp invocation): Likewise.

Affects coreutils <= 8.29

(From OE-Core rev: a523bc6a2ff7d5b5415a789de02fb055ccd2c077)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
c035a20028 libsndfile1: CVE-2017-14634
double64_init: Check psf->sf.channels against upper bound

This prevents division by zero later in the code.

While the trivial case to catch this (i.e. sf.channels < 1) has already
been covered, a crafted file may report a number of channels that is
so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets
miscalculated to zero (if this makes sense) in the determination of the
blockwidth. Since we only support a limited number of channels anyway,
make sure to check here as well.

CVE-2017-14634

Closes: #318

Affects libsndfile1 = 1.0.28

(From OE-Core rev: 00da7bad24cf78c9dba091b9e480515f25886b48)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
3c38e69639 libsndfile1: CVE-2017-14245 CVE-2017-14246
sfe_copy_data_fp: check value of "max" variable for being normal
and check elements of the data[] array for being finite.

Both checks use functions provided by the <math.h> header as declared
by the C99 standard.

Fixes #317
CVE-2017-14245
CVE-2017-14246

Affects libsndfile1 = 1.0.28

(From OE-Core rev: 39b1dc89ce2870d1a2630b2319783a6203cbcb08)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
c9b7487d4a libarchive: CVE-2017-14503
Reject LHA archive entries with negative size.

Affects libarchive = 3.3.2

(From OE-Core rev: 3e000591928cfc35df192c7eb00db65687930566)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Jagadeesh Krishnanjanappa
288dbefdf3 flac: CVE-2017-6888
stream_decoder.c: Fix a memory leak

Leak reported by Secunia Research.

Affects flac = 1.3.2

(From OE-Core rev: bca64ae1b02717c04edfee6dcc9a89cfa91d0c73)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Hongxu Jia
65000da237 nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10316
(From OE-Core rev: 10a52e436d2f9a40c04271bc8aeb04c75fb11383)

(From OE-Core rev: 058bdd077da005d412fbbcd98d70fbd80fa80555)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Changqing Li
70ab6ebf3e unzip: fix CVE-2018-1000035
(From OE-Core rev: f75289b9215580030540245cd0b5f945bfb05ffa)

(From OE-Core rev: 97a52df900519b0c7fbb9e92a3168a542d68aba6)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Ross Burton
c6b1f453b9 unzip: fix symlink problem
Large zip files can cause unzip to crash, take a patch from Fedora to fix it.

(From OE-Core rev: a001833b7c7a0a6eef88e053fe65e2a0c91ca7bc)

(From OE-Core rev: 61235238157b747d47728f6c3d9ad8241dde0102)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Andrej Valek
dc09a230d7 openssl: update 1.1.0h -> 1.1.0i
Please see this security advisory:
https://www.openssl.org/news/secadv/20180612.txt

Remove obsolete patch.

(From OE-Core rev: 0d19caefeeca14f44c80ccb716c30b17f14255a5)

(From OE-Core rev: 784059db22d763ca9f579a10a34fd90c68542e82)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Andrej Valek
205a56fcfa openssl: update 1.0.2o -> 1.0.2p
Please see this security advisory:
https://www.openssl.org/news/secadv/20180612.txt

Refresh patches

(From OE-Core rev: ff3db93e53c4f9d56807d3755c799459944e9a87)

(From OE-Core rev: 84233553e963e26ca5f9f983662d4bd133176bb9)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Andrej Valek
45e1ed092d openssl-1.1: fix c_rehash perl errors
Patch original c_rehash script with Debian patch instead
of overriding it with own version.

Error output from c_reshah without patching:
  Unknown regexp modifier "/b" at ./c_rehash line 15, at end of line
  Unknown regexp modifier "/W" at ./c_rehash line 28, at end of line
  Unknown regexp modifier "/3" at ./c_rehash line 28, at end of line
  Unknown regexp modifier "/2" at ./c_rehash line 28, at end of line
  No such class installdir at ./c_rehash line 63, near "Prefix our
  installdir"
    (Might be a runaway multi-line // string starting on line 28)
  syntax error at ./c_rehash line 63, near "Prefix our installdir"
  Can't redeclare "my" in "my" at ./c_rehash line 68, near ""
  Execution of ./c_rehash aborted due to compilation errors.

(From OE-Core rev: f8a826f497073533a3e4c390255ae197d65d6ef3)

(From OE-Core rev: 4524d1f916b55db6d280ff51a41933b8ec9046b0)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Marko Peter <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:51 +01:00
Andre McCurdy
b3c24d84a4 openssl_1.0: drop unnecessary call to perlpath.pl from do_configure()
The perlpath.pl script is used to patch the #! lines in all perl
scripts in the utils directory. However, as these scripts are run via
e.g. "perl foo.pl", they don't actually rely on the #! path to be
correct (which can be confirmed by the observation that the path is
currently being set to ${STAGING_BINDIR_NATIVE}/perl, which doesn't
exist).

(From OE-Core rev: ba88fe46d47846042518a5a1017d782ba548202c)

(From OE-Core rev: 1b0dcca0f083081295f32f09b408ab6c6c10f66f)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:50 +01:00