Pre Merge pull request !59 from casparant/a23
This commit is contained in:
casparant
Gitee
commit
41ab5a989b
4 changed files with 308 additions and 8 deletions
79
0090-CVE-2023-0687.patch
Normal file
79
0090-CVE-2023-0687.patch
Normal file
|
|
@ -0,0 +1,79 @@
|
||||||
|
From 801af9fafd4689337ebf27260aa115335a0cb2bc Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?utf8?q?=D0=9B=D0=B5=D0=BE=D0=BD=D0=B8=D0=B4=20=D0=AE=D1=80=D1=8C?=
|
||||||
|
=?utf8?q?=D0=B5=D0=B2=20=28Leonid=20Yuriev=29?= <leo@yuriev.ru>
|
||||||
|
Date: Sat, 4 Feb 2023 14:41:38 +0300
|
||||||
|
Subject: [PATCH] gmon: Fix allocated buffer overflow (bug 29444)
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=utf8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
The `__monstartup()` allocates a buffer used to store all the data
|
||||||
|
accumulated by the monitor.
|
||||||
|
|
||||||
|
The size of this buffer depends on the size of the internal structures
|
||||||
|
used and the address range for which the monitor is activated, as well
|
||||||
|
as on the maximum density of call instructions and/or callable functions
|
||||||
|
that could be potentially on a segment of executable code.
|
||||||
|
|
||||||
|
In particular a hash table of arcs is placed at the end of this buffer.
|
||||||
|
The size of this hash table is calculated in bytes as
|
||||||
|
p->fromssize = p->textsize / HASHFRACTION;
|
||||||
|
|
||||||
|
but actually should be
|
||||||
|
p->fromssize = ROUNDUP(p->textsize / HASHFRACTION, sizeof(*p->froms));
|
||||||
|
|
||||||
|
This results in writing beyond the end of the allocated buffer when an
|
||||||
|
added arc corresponds to a call near from the end of the monitored
|
||||||
|
address range, since `_mcount()` check the incoming caller address for
|
||||||
|
monitored range but not the intermediate result hash-like index that
|
||||||
|
uses to write into the table.
|
||||||
|
|
||||||
|
It should be noted that when the results are output to `gmon.out`, the
|
||||||
|
table is read to the last element calculated from the allocated size in
|
||||||
|
bytes, so the arcs stored outside the buffer boundary did not fall into
|
||||||
|
`gprof` for analysis. Thus this "feature" help me to found this bug
|
||||||
|
during working with https://sourceware.org/bugzilla/show_bug.cgi?id=29438
|
||||||
|
|
||||||
|
Just in case, I will explicitly note that the problem breaks the
|
||||||
|
`make test t=gmon/tst-gmon-dso` added for Bug 29438.
|
||||||
|
There, the arc of the `f3()` call disappears from the output, since in
|
||||||
|
the DSO case, the call to `f3` is located close to the end of the
|
||||||
|
monitored range.
|
||||||
|
|
||||||
|
Signed-off-by: Ðеонид ЮÑÑев (Leonid Yuriev) <leo@yuriev.ru>
|
||||||
|
|
||||||
|
Another minor error seems a related typo in the calculation of
|
||||||
|
`kcountsize`, but since kcounts are smaller than froms, this is
|
||||||
|
actually to align the p->froms data.
|
||||||
|
|
||||||
|
Co-authored-by: DJ Delorie <dj@redhat.com>
|
||||||
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
||||||
|
---
|
||||||
|
gmon/gmon.c | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/gmon/gmon.c b/gmon/gmon.c
|
||||||
|
index dee64803ad..bf76358d5b 100644
|
||||||
|
--- a/gmon/gmon.c
|
||||||
|
+++ b/gmon/gmon.c
|
||||||
|
@@ -132,6 +132,8 @@ __monstartup (u_long lowpc, u_long highpc)
|
||||||
|
p->lowpc = ROUNDDOWN(lowpc, HISTFRACTION * sizeof(HISTCOUNTER));
|
||||||
|
p->highpc = ROUNDUP(highpc, HISTFRACTION * sizeof(HISTCOUNTER));
|
||||||
|
p->textsize = p->highpc - p->lowpc;
|
||||||
|
+ /* This looks like a typo, but it's here to align the p->froms
|
||||||
|
+ section. */
|
||||||
|
p->kcountsize = ROUNDUP(p->textsize / HISTFRACTION, sizeof(*p->froms));
|
||||||
|
p->hashfraction = HASHFRACTION;
|
||||||
|
p->log_hashfraction = -1;
|
||||||
|
@@ -142,7 +144,7 @@ __monstartup (u_long lowpc, u_long highpc)
|
||||||
|
instead of integer division. Precompute shift amount. */
|
||||||
|
p->log_hashfraction = ffs(p->hashfraction * sizeof(*p->froms)) - 1;
|
||||||
|
}
|
||||||
|
- p->fromssize = p->textsize / HASHFRACTION;
|
||||||
|
+ p->fromssize = ROUNDUP(p->textsize / HASHFRACTION, sizeof(*p->froms));
|
||||||
|
p->tolimit = p->textsize * ARCDENSITY / 100;
|
||||||
|
if (p->tolimit < MINARCS)
|
||||||
|
p->tolimit = MINARCS;
|
||||||
|
--
|
||||||
|
2.39.3
|
||||||
|
|
||||||
216
0091-CVE-2024-2961.patch
Normal file
216
0091-CVE-2024-2961.patch
Normal file
|
|
@ -0,0 +1,216 @@
|
||||||
|
From e1135387deded5d73924f6ca20c72a35dc8e1bda Mon Sep 17 00:00:00 2001
|
||||||
|
From: Charles Fol <folcharles@gmail.com>
|
||||||
|
Date: Thu, 28 Mar 2024 12:25:38 -0300
|
||||||
|
Subject: [PATCH] iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing
|
||||||
|
escape sequence (CVE-2024-2961)
|
||||||
|
|
||||||
|
ISO-2022-CN-EXT uses escape sequences to indicate character set changes
|
||||||
|
(as specified by RFC 1922). While the SOdesignation has the expected
|
||||||
|
bounds checks, neither SS2designation nor SS3designation have its;
|
||||||
|
allowing a write overflow of 1, 2, or 3 bytes with fixed values:
|
||||||
|
'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.
|
||||||
|
|
||||||
|
Checked on aarch64-linux-gnu.
|
||||||
|
|
||||||
|
Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
||||||
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
||||||
|
Tested-by: Carlos O'Donell <carlos@redhat.com>
|
||||||
|
|
||||||
|
(cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada)
|
||||||
|
---
|
||||||
|
iconvdata/Makefile | 5 +-
|
||||||
|
iconvdata/iso-2022-cn-ext.c | 12 +++
|
||||||
|
iconvdata/tst-iconv-iso-2022-cn-ext.c | 128 ++++++++++++++++++++++++++
|
||||||
|
3 files changed, 144 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 iconvdata/tst-iconv-iso-2022-cn-ext.c
|
||||||
|
|
||||||
|
diff --git a/iconvdata/Makefile b/iconvdata/Makefile
|
||||||
|
index dd5cafab21..075098dce8 100644
|
||||||
|
--- a/iconvdata/Makefile
|
||||||
|
+++ b/iconvdata/Makefile
|
||||||
|
@@ -75,7 +75,8 @@ ifeq (yes,$(build-shared))
|
||||||
|
tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
|
||||||
|
tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
|
||||||
|
bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
|
||||||
|
- bug-iconv13 bug-iconv14 bug-iconv15
|
||||||
|
+ bug-iconv13 bug-iconv14 bug-iconv15 \
|
||||||
|
+ tst-iconv-iso-2022-cn-ext
|
||||||
|
ifeq ($(have-thread-library),yes)
|
||||||
|
tests += bug-iconv3
|
||||||
|
endif
|
||||||
|
@@ -330,6 +331,8 @@ $(objpfx)bug-iconv14.out: $(addprefix $(objpfx), $(gconv-modules)) \
|
||||||
|
$(addprefix $(objpfx),$(modules.so))
|
||||||
|
$(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
|
||||||
|
$(addprefix $(objpfx),$(modules.so))
|
||||||
|
+$(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \
|
||||||
|
+ $(addprefix $(objpfx),$(modules.so))
|
||||||
|
|
||||||
|
$(objpfx)iconv-test.out: run-iconv-test.sh \
|
||||||
|
$(addprefix $(objpfx), $(gconv-modules)) \
|
||||||
|
diff --git a/iconvdata/iso-2022-cn-ext.c b/iconvdata/iso-2022-cn-ext.c
|
||||||
|
index 36727f0865..9bb02238a3 100644
|
||||||
|
--- a/iconvdata/iso-2022-cn-ext.c
|
||||||
|
+++ b/iconvdata/iso-2022-cn-ext.c
|
||||||
|
@@ -574,6 +574,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
|
||||||
|
{ \
|
||||||
|
const char *escseq; \
|
||||||
|
\
|
||||||
|
+ if (outptr + 4 > outend) \
|
||||||
|
+ { \
|
||||||
|
+ result = __GCONV_FULL_OUTPUT; \
|
||||||
|
+ break; \
|
||||||
|
+ } \
|
||||||
|
+ \
|
||||||
|
assert (used == CNS11643_2_set); /* XXX */ \
|
||||||
|
escseq = "*H"; \
|
||||||
|
*outptr++ = ESC; \
|
||||||
|
@@ -587,6 +593,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
|
||||||
|
{ \
|
||||||
|
const char *escseq; \
|
||||||
|
\
|
||||||
|
+ if (outptr + 4 > outend) \
|
||||||
|
+ { \
|
||||||
|
+ result = __GCONV_FULL_OUTPUT; \
|
||||||
|
+ break; \
|
||||||
|
+ } \
|
||||||
|
+ \
|
||||||
|
assert ((used >> 5) >= 3 && (used >> 5) <= 7); \
|
||||||
|
escseq = "+I+J+K+L+M" + ((used >> 5) - 3) * 2; \
|
||||||
|
*outptr++ = ESC; \
|
||||||
|
diff --git a/iconvdata/tst-iconv-iso-2022-cn-ext.c b/iconvdata/tst-iconv-iso-2022-cn-ext.c
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..96a8765fd5
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/iconvdata/tst-iconv-iso-2022-cn-ext.c
|
||||||
|
@@ -0,0 +1,128 @@
|
||||||
|
+/* Verify ISO-2022-CN-EXT does not write out of the bounds.
|
||||||
|
+ Copyright (C) 2024 Free Software Foundation, Inc.
|
||||||
|
+ This file is part of the GNU C Library.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
+ modify it under the terms of the GNU Lesser General Public
|
||||||
|
+ License as published by the Free Software Foundation; either
|
||||||
|
+ version 2.1 of the License, or (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ Lesser General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU Lesser General Public
|
||||||
|
+ License along with the GNU C Library; if not, see
|
||||||
|
+ <https://www.gnu.org/licenses/>. */
|
||||||
|
+
|
||||||
|
+#include <stdio.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+
|
||||||
|
+#include <errno.h>
|
||||||
|
+#include <iconv.h>
|
||||||
|
+#include <sys/mman.h>
|
||||||
|
+
|
||||||
|
+#include <support/xunistd.h>
|
||||||
|
+#include <support/check.h>
|
||||||
|
+#include <support/support.h>
|
||||||
|
+
|
||||||
|
+/* The test sets up a two memory page buffer with the second page marked
|
||||||
|
+ PROT_NONE to trigger a fault if the conversion writes beyond the exact
|
||||||
|
+ expected amount. Then we carry out various conversions and precisely
|
||||||
|
+ place the start of the output buffer in order to trigger a SIGSEGV if the
|
||||||
|
+ process writes anywhere between 1 and page sized bytes more (only one
|
||||||
|
+ PROT_NONE page is setup as a canary) than expected. These tests exercise
|
||||||
|
+ all three of the cases in ISO-2022-CN-EXT where the converter must switch
|
||||||
|
+ character sets and may run out of buffer space while doing the
|
||||||
|
+ operation. */
|
||||||
|
+
|
||||||
|
+static int
|
||||||
|
+do_test (void)
|
||||||
|
+{
|
||||||
|
+ iconv_t cd = iconv_open ("ISO-2022-CN-EXT", "UTF-8");
|
||||||
|
+ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
|
||||||
|
+
|
||||||
|
+ char *ntf;
|
||||||
|
+ size_t ntfsize;
|
||||||
|
+ char *outbufbase;
|
||||||
|
+ {
|
||||||
|
+ int pgz = getpagesize ();
|
||||||
|
+ TEST_VERIFY_EXIT (pgz > 0);
|
||||||
|
+ ntfsize = 2 * pgz;
|
||||||
|
+
|
||||||
|
+ ntf = xmmap (NULL, ntfsize, PROT_READ | PROT_WRITE, MAP_PRIVATE
|
||||||
|
+ | MAP_ANONYMOUS, -1);
|
||||||
|
+ xmprotect (ntf + pgz, pgz, PROT_NONE);
|
||||||
|
+
|
||||||
|
+ outbufbase = ntf + pgz;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Check if SOdesignation escape sequence does not trigger an OOB write. */
|
||||||
|
+ {
|
||||||
|
+ char inbuf[] = "\xe4\xba\xa4\xe6\x8d\xa2";
|
||||||
|
+
|
||||||
|
+ for (int i = 0; i < 9; i++)
|
||||||
|
+ {
|
||||||
|
+ char *inp = inbuf;
|
||||||
|
+ size_t inleft = sizeof (inbuf) - 1;
|
||||||
|
+
|
||||||
|
+ char *outp = outbufbase - i;
|
||||||
|
+ size_t outleft = i;
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
|
||||||
|
+ == (size_t) -1);
|
||||||
|
+ TEST_COMPARE (errno, E2BIG);
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Same as before for SS2designation. */
|
||||||
|
+ {
|
||||||
|
+ char inbuf[] = "ã´½ \xe3\xb4\xbd";
|
||||||
|
+
|
||||||
|
+ for (int i = 0; i < 14; i++)
|
||||||
|
+ {
|
||||||
|
+ char *inp = inbuf;
|
||||||
|
+ size_t inleft = sizeof (inbuf) - 1;
|
||||||
|
+
|
||||||
|
+ char *outp = outbufbase - i;
|
||||||
|
+ size_t outleft = i;
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
|
||||||
|
+ == (size_t) -1);
|
||||||
|
+ TEST_COMPARE (errno, E2BIG);
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Same as before for SS3designation. */
|
||||||
|
+ {
|
||||||
|
+ char inbuf[] = "å \xe5\x8a\x84";
|
||||||
|
+
|
||||||
|
+ for (int i = 0; i < 14; i++)
|
||||||
|
+ {
|
||||||
|
+ char *inp = inbuf;
|
||||||
|
+ size_t inleft = sizeof (inbuf) - 1;
|
||||||
|
+
|
||||||
|
+ char *outp = outbufbase - i;
|
||||||
|
+ size_t outleft = i;
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
|
||||||
|
+ == (size_t) -1);
|
||||||
|
+ TEST_COMPARE (errno, E2BIG);
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY_EXIT (iconv_close (cd) != -1);
|
||||||
|
+
|
||||||
|
+ xmunmap (ntf, ntfsize);
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+#include <support/test-driver.c>
|
||||||
|
--
|
||||||
|
2.39.3
|
||||||
|
|
||||||
21
glibc.spec
21
glibc.spec
|
|
@ -1,4 +1,4 @@
|
||||||
%define anolis_release 1
|
%define anolis_release 2
|
||||||
|
|
||||||
%bcond_without testsuite
|
%bcond_without testsuite
|
||||||
%bcond_without benchtests
|
%bcond_without benchtests
|
||||||
|
|
@ -95,13 +95,15 @@ Patch7: glibc-deprecated-selinux-makedb.patch
|
||||||
# https://sourceware.org/bugzilla/show_bug.cgi?id=30243
|
# https://sourceware.org/bugzilla/show_bug.cgi?id=30243
|
||||||
Patch8: glibc-gb18030-2022-bug30243.patch
|
Patch8: glibc-gb18030-2022-bug30243.patch
|
||||||
|
|
||||||
Patch0183: 0083-CVE-2023-4527.patch
|
Patch0083: 0083-CVE-2023-4527.patch
|
||||||
Patch0184: 0084-CVE-2023-4806.patch
|
Patch0084: 0084-CVE-2023-4806.patch
|
||||||
Patch0185: 0085-CVE-2023-5156.patch
|
Patch0085: 0085-CVE-2023-5156.patch
|
||||||
Patch0186: 1086-CVE-2023-4911.patch
|
Patch0086: 0086-CVE-2023-4911.patch
|
||||||
Patch0187: 0087-CVE-2023-6246.patch
|
Patch0087: 0087-CVE-2023-6246.patch
|
||||||
Patch0188: 0088-CVE-2023-6779.patch
|
Patch0088: 0088-CVE-2023-6779.patch
|
||||||
Patch0189: 0089-CVE-2023-6780.patch
|
Patch0089: 0089-CVE-2023-6780.patch
|
||||||
|
Patch0090: 0090-CVE-2023-0687.patch
|
||||||
|
Patch0091: 0091-CVE-2024-2961.patch
|
||||||
|
|
||||||
BuildRequires: audit-libs-devel >= 1.1.3 libcap-devel systemtap-sdt-devel
|
BuildRequires: audit-libs-devel >= 1.1.3 libcap-devel systemtap-sdt-devel
|
||||||
BuildRequires: procps-ng util-linux gawk sed >= 3.95 gettext
|
BuildRequires: procps-ng util-linux gawk sed >= 3.95 gettext
|
||||||
|
|
@ -1055,6 +1057,9 @@ update_gconv_modules_cache ()
|
||||||
%{_libdir}/libpthread_nonshared.a
|
%{_libdir}/libpthread_nonshared.a
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Apr 26 2024 Caspar Zhang <caspar@linux.alibaba.com> - 2.38-2
|
||||||
|
- fix CVE-2023-0687, CVE-2024-2961
|
||||||
|
|
||||||
* Tue Mar 05 2024 mgb01105731 <mgb01105731@alibaba-inc.com> - 2.38-1
|
* Tue Mar 05 2024 mgb01105731 <mgb01105731@alibaba-inc.com> - 2.38-1
|
||||||
- update to 2.38
|
- update to 2.38
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue