From bba38f38e7e41525c30116a2fe990d113b8157da Mon Sep 17 00:00:00 2001 From: Brad Bishop Date: Thu, 23 Aug 2018 16:11:46 +0800 Subject: poky: sumo refresh 51872d3f99..3b8dc3a88e Update poky to sumo HEAD. Andrej Valek (1): wpa-supplicant: fix CVE-2018-14526 Armin Kuster (2): xserver-xorg: config: fix NULL value detection for ID_INPUT being unset binutils: Change the ARM assembler's ADR and ADRl pseudo-ops so that they will only set the bottom bit of imported thumb function symbols if the -mthumb-interwork option is active. Bruce Ashfield (3): linux-yocto/4.12: update to v4.12.28 linux-yocto/4.14: update to v4.14.62 linux-yocto/4.14: update to v4.14.67 Changqing Li (6): libexif: patch for CVE-2017-7544 squashfs-tools: patch for CVE-2015-4645(4646) libcroco: patch for CVE-2017-7960 libid3tag: patch for CVE-2004-2779 libice: patch for CVE-2017-2626 apr-util: fix ptest fail problem Chen Qi (2): util-linux: upgrade 2.32 -> 2.32.1 busybox: move init related configs to init.cfg Jagadeesh Krishnanjanappa (2): libarchive: CVE-2017-14501 libcgroup: CVE-2018-14348 Jon Szymaniak (1): cve-check.bbclass: detect CVE IDs listed on multiple lines Joshua Lock (1): os-release: fix to install in the expected location Khem Raj (1): serf: Fix Sconstruct build with python 3.7 Konstantin Shemyak (1): cve-check.bbclass: do not download the CVE DB in package-specific tasks Mike Looijmans (1): busybox/mdev-mount.sh: Fix partition detect and cleanup mountpoint on fail Ross Burton (1): lrzsz: fix CVE-2018-10195 Sinan Kaya (3): busybox: CVE-2017-15874 libpng: CVE-2018-13785 sqlite3: CVE-2018-8740 Yadi.hu (1): busybox: handle syslog Yi Zhao (2): blktrace: Security fix CVE-2018-10689 taglib: Security fix CVE-2018-11439 Zheng Ruoqin (1): glibc: fix CVE-2018-11237 Change-Id: I2eb1fe6574638de745e4bfc106b86fe797b977c8 Signed-off-by: Brad Bishop --- poky/meta/classes/cve-check.bbclass | 12 +- .../lrzsz/lrzsz-0.12.20/cve-2018-10195.patch | 28 ++++ poky/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb | 1 + .../wpa_supplicant-CVE-2018-14526.patch | 44 ++++++ .../wpa-supplicant/wpa-supplicant_2.6.bb | 1 + poky/meta/recipes-core/busybox/busybox.inc | 14 +- .../busybox/busybox/CVE-2017-15874.patch | 30 ++++ poky/meta/recipes-core/busybox/busybox/defconfig | 12 +- poky/meta/recipes-core/busybox/busybox/init.cfg | 7 +- poky/meta/recipes-core/busybox/busybox_1.27.2.bb | 1 + poky/meta/recipes-core/busybox/files/mdev-mount.sh | 4 +- .../recipes-core/glibc/glibc/CVE-2018-11237.patch | 82 ++++++++++ poky/meta/recipes-core/glibc/glibc_2.27.bb | 1 + .../libcgroup/libcgroup/CVE-2018-14348.patch | 37 +++++ poky/meta/recipes-core/libcgroup/libcgroup_0.41.bb | 3 +- poky/meta/recipes-core/os-release/os-release.bb | 9 +- .../recipes-core/util-linux/util-linux_2.32.1.bb | 30 ++++ .../recipes-core/util-linux/util-linux_2.32.bb | 30 ---- .../recipes-devtools/binutils/binutils-2.30.inc | 1 + ...ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch | 176 +++++++++++++++++++++ ...-squashfs-tools-patch-for-CVE-2015-4645-6.patch | 47 ++++++ .../squashfs-tools/squashfs-tools_git.bb | 1 + .../libarchive/libarchive/CVE-2017-14501.patch | 79 +++++++++ .../libarchive/libarchive_3.3.2.bb | 1 + .../xorg-lib/libice/CVE-2017-2626.patch | 149 +++++++++++++++++ .../meta/recipes-graphics/xorg-lib/libice_1.0.9.bb | 2 + ...NULL-value-detection-for-ID_INPUT-being-u.patch | 40 +++++ .../xorg-xserver/xserver-xorg_1.19.6.bb | 1 + .../blktrace/blktrace/CVE-2018-10689.patch | 150 ++++++++++++++++++ poky/meta/recipes-kernel/blktrace/blktrace_git.bb | 1 + .../recipes-kernel/linux/linux-yocto-rt_4.12.bb | 6 +- .../recipes-kernel/linux/linux-yocto-rt_4.14.bb | 6 +- .../recipes-kernel/linux/linux-yocto-tiny_4.12.bb | 6 +- .../recipes-kernel/linux/linux-yocto-tiny_4.14.bb | 6 +- poky/meta/recipes-kernel/linux/linux-yocto_4.12.bb | 20 +-- poky/meta/recipes-kernel/linux/linux-yocto_4.14.bb | 20 +-- .../libid3tag/libid3tag/10_utf16.dpatch | 33 ++++ .../libid3tag/libid3tag_0.15.1b.bb | 1 + .../libpng/files/CVE-2018-13785.patch | 37 +++++ .../recipes-multimedia/libpng/libpng_1.6.34.bb | 4 +- .../apr-util/0001-Fix-error-handling-in-gdbm.patch | 135 ++++++++++++++++ poky/meta/recipes-support/apr/apr-util_1.6.1.bb | 1 + .../libcroco/libcroco/CVE-2017-7960.patch | 56 +++++++ .../recipes-support/libcroco/libcroco_0.6.12.bb | 2 + .../libexif/libexif/CVE-2017-7544.patch | 40 +++++ .../meta/recipes-support/libexif/libexif_0.6.21.bb | 3 +- ...of-a-print-in-the-scons-file-to-unbreak-b.patch | 29 ++++ ...truct-Fix-path-quoting-for-.def-generator.patch | 27 ++++ .../recipes-support/serf/serf/0003-gen_def.patch | 22 +++ ...o-r1811083-fix-building-with-scons-3.0.0-.patch | 29 ++++ poky/meta/recipes-support/serf/serf_1.3.9.bb | 7 +- .../sqlite/files/CVE-2018-8740.patch | 47 ++++++ poky/meta/recipes-support/sqlite/sqlite3_3.22.0.bb | 1 + .../taglib/taglib/CVE-2018-11439.patch | 51 ++++++ poky/meta/recipes-support/taglib/taglib_1.11.1.bb | 1 + 55 files changed, 1496 insertions(+), 88 deletions(-) create mode 100644 poky/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/cve-2018-10195.patch create mode 100644 poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/wpa_supplicant-CVE-2018-14526.patch create mode 100644 poky/meta/recipes-core/busybox/busybox/CVE-2017-15874.patch create mode 100644 poky/meta/recipes-core/glibc/glibc/CVE-2018-11237.patch create mode 100644 poky/meta/recipes-core/libcgroup/libcgroup/CVE-2018-14348.patch create mode 100644 poky/meta/recipes-core/util-linux/util-linux_2.32.1.bb delete mode 100644 poky/meta/recipes-core/util-linux/util-linux_2.32.bb create mode 100644 poky/meta/recipes-devtools/binutils/binutils/0001-Change-the-ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch create mode 100644 poky/meta/recipes-devtools/squashfs-tools/squashfs-tools/0001-squashfs-tools-patch-for-CVE-2015-4645-6.patch create mode 100644 poky/meta/recipes-extended/libarchive/libarchive/CVE-2017-14501.patch create mode 100644 poky/meta/recipes-graphics/xorg-lib/libice/CVE-2017-2626.patch create mode 100644 poky/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-config-fix-NULL-value-detection-for-ID_INPUT-being-u.patch create mode 100644 poky/meta/recipes-kernel/blktrace/blktrace/CVE-2018-10689.patch create mode 100644 poky/meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.dpatch create mode 100644 poky/meta/recipes-multimedia/libpng/files/CVE-2018-13785.patch create mode 100644 poky/meta/recipes-support/apr/apr-util/0001-Fix-error-handling-in-gdbm.patch create mode 100644 poky/meta/recipes-support/libcroco/libcroco/CVE-2017-7960.patch create mode 100644 poky/meta/recipes-support/libexif/libexif/CVE-2017-7544.patch create mode 100644 poky/meta/recipes-support/serf/serf/0001-Fix-syntax-of-a-print-in-the-scons-file-to-unbreak-b.patch create mode 100644 poky/meta/recipes-support/serf/serf/0002-SConstruct-Fix-path-quoting-for-.def-generator.patch create mode 100644 poky/meta/recipes-support/serf/serf/0003-gen_def.patch create mode 100644 poky/meta/recipes-support/serf/serf/0004-Follow-up-to-r1811083-fix-building-with-scons-3.0.0-.patch create mode 100644 poky/meta/recipes-support/sqlite/files/CVE-2018-8740.patch create mode 100644 poky/meta/recipes-support/taglib/taglib/CVE-2018-11439.patch diff --git a/poky/meta/classes/cve-check.bbclass b/poky/meta/classes/cve-check.bbclass index 537659df1..12ad3e5c5 100644 --- a/poky/meta/classes/cve-check.bbclass +++ b/poky/meta/classes/cve-check.bbclass @@ -146,15 +146,17 @@ def get_patches_cves(d): with open(patch_file, "r", encoding="iso8859-1") as f: patch_text = f.read() - # Search for the "CVE: " line - match = cve_match.search(patch_text) - if match: + # Search for one or more "CVE: " lines + text_match = False + for match in cve_match.finditer(patch_text): # Get only the CVEs without the "CVE: " tag cves = patch_text[match.start()+5:match.end()] for cve in cves.split(): bb.debug(2, "Patch %s solves %s" % (patch_file, cve)) patched_cves.add(cve) - elif not fname_match: + text_match = True + + if not fname_match and not text_match: bb.debug(2, "Patch %s doesn't solve CVEs" % patch_file) return patched_cves @@ -177,7 +179,7 @@ def check_cves(d, patched_cves): cve_db_dir = d.getVar("CVE_CHECK_DB_DIR") cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST")) cve_cmd = "cve-check-tool" - cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir] + cmd = [cve_cmd, "--no-html", "--skip-update", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir] # If the recipe has been whitlisted we return empty lists if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split(): diff --git a/poky/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/cve-2018-10195.patch b/poky/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/cve-2018-10195.patch new file mode 100644 index 000000000..dea298634 --- /dev/null +++ b/poky/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/cve-2018-10195.patch @@ -0,0 +1,28 @@ +Integer overflow in src/zm.c:zsdata() causes crash in sz and can leak information to receiver. + +Patch taken from Fedora. + +CVE: CVE-2018-10195 +Upstream-Status: Inappropriate (dead upstream) +Signed-off-by: Ross Burton + +diff -urN lrzsz-0.12.20/src/zm.c lrzsz-0.12.20.new/src/zm.c +--- lrzsz-0.12.20/src/zm.c Tue Dec 29 09:48:38 1998 ++++ lrzsz-0.12.20.new/src/zm.c Tue Oct 8 12:46:58 2002 +@@ -431,10 +431,12 @@ + VPRINTF(3,("zsdata: %lu %s", (unsigned long) length, + Zendnames[(frameend-ZCRCE)&3])); + crc = 0; +- do { +- zsendline(*buf); crc = updcrc((0377 & *buf), crc); +- buf++; +- } while (--length>0); ++ ++ for( ; length; length--) { ++ zsendline(*buf); crc = updcrc((0377 & *buf), crc); ++ buf++; ++ } ++ + xsendline(ZDLE); xsendline(frameend); + crc = updcrc(frameend, crc); + \ No newline at end of file diff --git a/poky/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb b/poky/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb index 4b349be32..002c774c6 100644 --- a/poky/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb +++ b/poky/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb @@ -19,6 +19,7 @@ SRC_URI = "http://www.ohse.de/uwe/releases/lrzsz-${PV}.tar.gz \ file://acdefine.patch \ file://lrzsz_fix_for_automake-1.12.patch \ file://lrzsz-check-locale.h.patch \ + file://cve-2018-10195.patch \ " SRC_URI[md5sum] = "b5ce6a74abc9b9eb2af94dffdfd372a4" diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/wpa_supplicant-CVE-2018-14526.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/wpa_supplicant-CVE-2018-14526.patch new file mode 100644 index 000000000..e800a410e --- /dev/null +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/wpa_supplicant-CVE-2018-14526.patch @@ -0,0 +1,44 @@ +wpa_supplicant-2.6: Fix CVE-2018-14526 + +[No upstream tracking] -- https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt + +wpa: Ignore unauthenticated encrypted EAPOL-Key data + +Ignore unauthenticated encrypted EAPOL-Key data in supplicant +processing. When using WPA2, these are frames that have the Encrypted +flag set, but not the MIC flag. + +When using WPA2, EAPOL-Key frames that had the Encrypted flag set but +not the MIC flag, had their data field decrypted without first verifying +the MIC. In case the data field was encrypted using RC4 (i.e., when +negotiating TKIP as the pairwise cipher), this meant that +unauthenticated but decrypted data would then be processed. An adversary +could abuse this as a decryption oracle to recover sensitive information +in the data field of EAPOL-Key messages (e.g., the group key). + +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/src/rsn_supp/wpa.c?id=3e34cfdff6b192fe337c6fb3f487f73e96582961] +CVE: CVE-2018-14526 +Signed-off-by: Andrej Valek + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 3c47879..6bdf923 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2016,6 +2016,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr, + + if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) && + (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) { ++ /* ++ * Only decrypt the Key Data field if the frame's authenticity ++ * was verified. When using AES-SIV (FILS), the MIC flag is not ++ * set, so this check should only be performed if mic_len != 0 ++ * which is the case in this code branch. ++ */ ++ if (!(key_info & WPA_KEY_INFO_MIC)) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data"); ++ goto out; ++ } + if (wpa_supplicant_decrypt_key_data(sm, key, ver, key_data, + &key_data_len)) + goto out; diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.6.bb b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.6.bb index e68453748..aa4c4c2da 100644 --- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.6.bb +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.6.bb @@ -32,6 +32,7 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \ file://key-replay-cve-multiple6.patch \ file://key-replay-cve-multiple7.patch \ file://key-replay-cve-multiple8.patch \ + file://wpa_supplicant-CVE-2018-14526.patch \ " SRC_URI[md5sum] = "091569eb4440b7d7f2b4276dbfc03c3c" SRC_URI[sha256sum] = "b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b1450" diff --git a/poky/meta/recipes-core/busybox/busybox.inc b/poky/meta/recipes-core/busybox/busybox.inc index d1675c37a..8c6dbbaf9 100644 --- a/poky/meta/recipes-core/busybox/busybox.inc +++ b/poky/meta/recipes-core/busybox/busybox.inc @@ -315,20 +315,24 @@ do_install () { fi if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then + if grep -q "CONFIG_KLOGD=y" ${B}/.config; then + install -d ${D}${systemd_unitdir}/system + sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-klogd.service.in \ + > ${D}${systemd_unitdir}/system/busybox-klogd.service + fi + if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then install -d ${D}${systemd_unitdir}/system sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-syslog.service.in \ > ${D}${systemd_unitdir}/system/busybox-syslog.service + if [ ! -e ${D}${systemd_unitdir}/system/busybox-klogd.service ] ; then + sed -i '/klog/d' ${D}${systemd_unitdir}/system/busybox-syslog.service + fi if [ -f ${WORKDIR}/busybox-syslog.default ] ; then install -d ${D}${sysconfdir}/default install -m 0644 ${WORKDIR}/busybox-syslog.default ${D}${sysconfdir}/default/busybox-syslog fi fi - if grep -q "CONFIG_KLOGD=y" ${B}/.config; then - install -d ${D}${systemd_unitdir}/system - sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-klogd.service.in \ - > ${D}${systemd_unitdir}/system/busybox-klogd.service - fi fi # Remove the sysvinit specific configuration file for systemd systems to avoid confusion diff --git a/poky/meta/recipes-core/busybox/busybox/CVE-2017-15874.patch b/poky/meta/recipes-core/busybox/busybox/CVE-2017-15874.patch new file mode 100644 index 000000000..67b4ed7e1 --- /dev/null +++ b/poky/meta/recipes-core/busybox/busybox/CVE-2017-15874.patch @@ -0,0 +1,30 @@ +From e75c01bb3249df16201b482b79bb24bec3b58188 Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko +Date: Fri, 27 Oct 2017 15:37:03 +0200 +Subject: [PATCH] unlzma: fix SEGV, closes 10436 + +Upstream-Status: Backport [ https://git.busybox.net/busybox/commit/?id=9ac42c500586fa5f10a1f6d22c3f797df11b1f6b] +Signed-off-by: Denys Vlasenko +Signed-off-by: Sinan Kaya +--- + archival/libarchive/decompress_unlzma.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c +index 29eee2a..41e492f 100644 +--- a/archival/libarchive/decompress_unlzma.c ++++ b/archival/libarchive/decompress_unlzma.c +@@ -353,6 +353,10 @@ unpack_lzma_stream(transformer_state_t *xstate) + pos = buffer_pos - rep0; + if ((int32_t)pos < 0) { + pos += header.dict_size; ++ /* bug 10436 has an example file where this triggers: */ ++ if ((int32_t)pos < 0) ++ goto bad; ++ + /* see unzip_bad_lzma_2.zip: */ + if (pos >= buffer_size) + goto bad; +-- +2.19.0 + diff --git a/poky/meta/recipes-core/busybox/busybox/defconfig b/poky/meta/recipes-core/busybox/busybox/defconfig index fbb5fd852..59d93c707 100644 --- a/poky/meta/recipes-core/busybox/busybox/defconfig +++ b/poky/meta/recipes-core/busybox/busybox/defconfig @@ -468,21 +468,21 @@ CONFIG_FEATURE_XARGS_SUPPORT_REPL_STR=y # CONFIG_BOOTCHARTD is not set # CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER is not set # CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE is not set -CONFIG_HALT=y -CONFIG_POWEROFF=y -CONFIG_REBOOT=y +# CONFIG_HALT is not set +# CONFIG_POWEROFF is not set +# CONFIG_REBOOT is not set # CONFIG_FEATURE_CALL_TELINIT is not set -CONFIG_TELINIT_PATH="" +# CONFIG_TELINIT_PATH is not set # CONFIG_INIT is not set # CONFIG_LINUXRC is not set # CONFIG_FEATURE_USE_INITTAB is not set # CONFIG_FEATURE_KILL_REMOVED is not set -CONFIG_FEATURE_KILL_DELAY=0 +# CONFIG_FEATURE_KILL_DELAY is not set # CONFIG_FEATURE_INIT_SCTTY is not set # CONFIG_FEATURE_INIT_SYSLOG is not set # CONFIG_FEATURE_INIT_QUIET is not set # CONFIG_FEATURE_INIT_COREDUMPS is not set -CONFIG_INIT_TERMINAL_TYPE="" +# CONFIG_INIT_TERMINAL_TYPE is not set # CONFIG_FEATURE_INIT_MODIFY_CMDLINE is not set # diff --git a/poky/meta/recipes-core/busybox/busybox/init.cfg b/poky/meta/recipes-core/busybox/busybox/init.cfg index 006d4c633..3c1fdd42b 100644 --- a/poky/meta/recipes-core/busybox/busybox/init.cfg +++ b/poky/meta/recipes-core/busybox/busybox/init.cfg @@ -1,3 +1,8 @@ CONFIG_INIT=y CONFIG_FEATURE_USE_INITTAB=y - +CONFIG_HALT=y +CONFIG_POWEROFF=y +CONFIG_REBOOT=y +CONFIG_FEATURE_KILL_DELAY=0 +CONFIG_TELINIT_PATH="" +CONFIG_INIT_TERMINAL_TYPE="" diff --git a/poky/meta/recipes-core/busybox/busybox_1.27.2.bb b/poky/meta/recipes-core/busybox/busybox_1.27.2.bb index 1ce4823d4..bab29728e 100644 --- a/poky/meta/recipes-core/busybox/busybox_1.27.2.bb +++ b/poky/meta/recipes-core/busybox/busybox_1.27.2.bb @@ -47,6 +47,7 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://busybox-CVE-2017-16544.patch \ file://busybox-fix-lzma-segfaults.patch \ file://umount-ignore-c.patch \ + file://CVE-2017-15874.patch \ " SRC_URI_append_libc-musl = " file://musl.cfg " diff --git a/poky/meta/recipes-core/busybox/files/mdev-mount.sh b/poky/meta/recipes-core/busybox/files/mdev-mount.sh index b4385a157..130e9472f 100644 --- a/poky/meta/recipes-core/busybox/files/mdev-mount.sh +++ b/poky/meta/recipes-core/busybox/files/mdev-mount.sh @@ -25,7 +25,7 @@ case "$ACTION" in fi # check for full-disk partition if [ "${DEVBASE}" = "${MDEV}" ] ; then - if [ -d /sys/block/${DEVBASE}/${DEVBASE}*1 ] ; then + if [ -f /sys/block/${DEVBASE}/${DEVBASE}*1/partition ] ; then # Partition detected, just quit exit 0 fi @@ -43,7 +43,7 @@ case "$ACTION" in then MOUNTPOINT="${MDEV_AUTOMOUNT_ROOT}/$MDEV" mkdir -p "$MOUNTPOINT" - mount -t auto /dev/$MDEV "$MOUNTPOINT" + mount -t auto /dev/$MDEV "$MOUNTPOINT" || rmdir "$MOUNTPOINT" fi ;; remove) diff --git a/poky/meta/recipes-core/glibc/glibc/CVE-2018-11237.patch b/poky/meta/recipes-core/glibc/glibc/CVE-2018-11237.patch new file mode 100644 index 000000000..632aa565e --- /dev/null +++ b/poky/meta/recipes-core/glibc/glibc/CVE-2018-11237.patch @@ -0,0 +1,82 @@ +From 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Tue, 22 May 2018 10:37:59 +0200 +Subject: [PATCH] Don't write beyond destination in + __mempcpy_avx512_no_vzeroupper (bug 23196) + +When compiled as mempcpy, the return value is the end of the destination +buffer, thus it cannot be used to refer to the start of it. + +2018-05-23 Andreas Schwab + + [BZ #23196] + CVE-2018-11237 + * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S + (L(preloop_large)): Save initial destination pointer in %r11 and + use it instead of %rax after the loop. + * string/test-mempcpy.c (MIN_PAGE_SIZE): Define. + +CVE: CVE-2018-11237 +Upstream-Status: Backport +Signed-off-by: Zheng Ruoqin +--- + ChangeLog | 9 +++++++++ + string/test-mempcpy.c | 1 + + sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++-- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index fa0a07c..bc09dec 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,12 @@ ++2018-05-23 Andreas Schwab ++ ++ [BZ #23196] ++ CVE-2018-11237 ++ * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S ++ (L(preloop_large)): Save initial destination pointer in %r11 and ++ use it instead of %rax after the loop. ++ * string/test-mempcpy.c (MIN_PAGE_SIZE): Define. ++ + 2018-05-09 Paul Pluzhnikov + + [BZ #22786] +diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c +index c08fba8..d98ecdd 100644 +--- a/string/test-mempcpy.c ++++ b/string/test-mempcpy.c +@@ -18,6 +18,7 @@ + . */ + + #define MEMCPY_RESULT(dst, len) (dst) + (len) ++#define MIN_PAGE_SIZE 131072 + #define TEST_MAIN + #define TEST_NAME "mempcpy" + #include "test-string.h" +diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S +index 23c0f7a..a55cf6f 100644 +--- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S ++++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S +@@ -335,6 +335,7 @@ L(preloop_large): + ja L(preloop_large_bkw) + vmovups (%rsi), %zmm4 + vmovups 0x40(%rsi), %zmm5 ++ mov %rdi, %r11 + + /* Align destination for access with non-temporal stores in the loop. */ + mov %rdi, %r8 +@@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop): + cmp $256, %rdx + ja L(gobble_256bytes_nt_loop) + sfence +- vmovups %zmm4, (%rax) +- vmovups %zmm5, 0x40(%rax) ++ vmovups %zmm4, (%r11) ++ vmovups %zmm5, 0x40(%r11) + jmp L(check) + + L(preloop_large_bkw): +-- +2.7.4 + diff --git a/poky/meta/recipes-core/glibc/glibc_2.27.bb b/poky/meta/recipes-core/glibc/glibc_2.27.bb index 22a9881ea..adee494c2 100644 --- a/poky/meta/recipes-core/glibc/glibc_2.27.bb +++ b/poky/meta/recipes-core/glibc/glibc_2.27.bb @@ -47,6 +47,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0030-plural_c_no_preprocessor_lines.patch \ file://CVE-2017-18269.patch \ file://CVE-2018-11236.patch \ + file://CVE-2018-11237.patch \ " NATIVESDKFIXES ?= "" diff --git a/poky/meta/recipes-core/libcgroup/libcgroup/CVE-2018-14348.patch b/poky/meta/recipes-core/libcgroup/libcgroup/CVE-2018-14348.patch new file mode 100644 index 000000000..d133703de --- /dev/null +++ b/poky/meta/recipes-core/libcgroup/libcgroup/CVE-2018-14348.patch @@ -0,0 +1,37 @@ +From 0d88b73d189ea3440ccaab00418d6469f76fa590 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Wed, 18 Jul 2018 11:24:29 +0200 +Subject: [PATCH] cgrulesengd: remove umask(0) + +One of our partners has noticed that cgred daemon is creating a log file +(/var/log/cgred) with too wide permissions (0666) and that is seen as +a security bug because an untrusted user can write to otherwise +restricted area. CVE-2018-14348 has been assigned to this issue. + +CVE: CVE-2018-14348 +Upstream-Status: Backport [https://sourceforge.net/p/libcg/libcg/ci/0d88b73d189ea3440ccaab00418d6469f76fa590] + +Signed-off-by: Michal Hocko +Acked-by: Balbir Singh +Signed-off-by: Jagadeesh Krishnanjanappa +--- + src/daemon/cgrulesengd.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/src/daemon/cgrulesengd.c b/src/daemon/cgrulesengd.c +index ea51f11..0d288f3 100644 +--- a/src/daemon/cgrulesengd.c ++++ b/src/daemon/cgrulesengd.c +@@ -889,9 +889,6 @@ int cgre_start_daemon(const char *logp, const int logf, + } else if (pid > 0) { + exit(EXIT_SUCCESS); + } +- +- /* Change the file mode mask. */ +- umask(0); + } else { + flog(LOG_DEBUG, "Not using daemon mode\n"); + pid = getpid(); +-- +2.13.3 + diff --git a/poky/meta/recipes-core/libcgroup/libcgroup_0.41.bb b/poky/meta/recipes-core/libcgroup/libcgroup_0.41.bb index 7ddc81e9b..92d7261b0 100644 --- a/poky/meta/recipes-core/libcgroup/libcgroup_0.41.bb +++ b/poky/meta/recipes-core/libcgroup/libcgroup_0.41.bb @@ -11,7 +11,8 @@ inherit autotools pkgconfig DEPENDS = "bison-native flex-native" -SRC_URI = "${SOURCEFORGE_MIRROR}/project/libcg/${BPN}/v0.41/${BPN}-${PV}.tar.bz2" +SRC_URI = "${SOURCEFORGE_MIRROR}/project/libcg/${BPN}/v0.41/${BPN}-${PV}.tar.bz2 \ + file://CVE-2018-14348.patch" SRC_URI_append_libc-musl = " file://musl-decls-compat.patch" SRC_URI[md5sum] = "3dea9d50b8a5b73ff0bf1cdcb210f63f" diff --git a/poky/meta/recipes-core/os-release/os-release.bb b/poky/meta/recipes-core/os-release/os-release.bb index f98870475..bf4f815a1 100644 --- a/poky/meta/recipes-core/os-release/os-release.bb +++ b/poky/meta/recipes-core/os-release/os-release.bb @@ -1,7 +1,7 @@ inherit allarch SUMMARY = "Operating system identification" -DESCRIPTION = "The /etc/os-release file contains operating system identification data." +DESCRIPTION = "The /usr/lib/os-release file contains operating system identification data." LICENSE = "MIT" INHIBIT_DEFAULT_DEPS = "1" @@ -42,6 +42,9 @@ python do_compile () { do_compile[vardeps] += "${OS_RELEASE_FIELDS}" do_install () { - install -d ${D}${sysconfdir} - install -m 0644 os-release ${D}${sysconfdir}/ + install -d ${D}${libdir} ${D}${sysconfdir} + install -m 0644 os-release ${D}${libdir}/ + lnr ${D}${libdir}/os-release ${D}${sysconfdir}/os-release } + +FILES_${PN} += "${libdir}/os-release" diff --git a/poky/meta/recipes-core/util-linux/util-linux_2.32.1.bb b/poky/meta/recipes-core/util-linux/util-linux_2.32.1.bb new file mode 100644 index 000000000..455b9377b --- /dev/null +++ b/poky/meta/recipes-core/util-linux/util-linux_2.32.1.bb @@ -0,0 +1,30 @@ +MAJOR_VERSION = "2.32" +require util-linux.inc + +# To support older hosts, we need to patch and/or revert +# some upstream changes. Only do this for native packages. +OLDHOST = "" +OLDHOST_class-native = "file://util-linux-native-qsort.patch" + +SRC_URI += "file://configure-sbindir.patch \ + file://runuser.pamd \ + file://runuser-l.pamd \ + ${OLDHOST} \ + file://ptest.patch \ + file://run-ptest \ + file://display_testname_for_subtest.patch \ + file://avoid_parallel_tests.patch \ +" +SRC_URI[md5sum] = "9e5b1b8c1dc99455bdb6b462cf9436d9" +SRC_URI[sha256sum] = "86e6707a379c7ff5489c218cfaf1e3464b0b95acf7817db0bc5f179e356a67b2" + +CACHED_CONFIGUREVARS += "scanf_cv_alloc_modifier=ms" + +EXTRA_OECONF_class-native = "${SHARED_EXTRA_OECONF} \ + --disable-fallocate \ + --disable-use-tty-group \ +" +EXTRA_OECONF_class-nativesdk = "${SHARED_EXTRA_OECONF} \ + --disable-fallocate \ + --disable-use-tty-group \ +" diff --git a/poky/meta/recipes-core/util-linux/util-linux_2.32.bb b/poky/meta/recipes-core/util-linux/util-linux_2.32.bb deleted file mode 100644 index 55cc98c20..000000000 --- a/poky/meta/recipes-core/util-linux/util-linux_2.32.bb +++ /dev/null @@ -1,30 +0,0 @@ -MAJOR_VERSION = "2.32" -require util-linux.inc - -# To support older hosts, we need to patch and/or revert -# some upstream changes. Only do this for native packages. -OLDHOST = "" -OLDHOST_class-native = "file://util-linux-native-qsort.patch" - -SRC_URI += "file://configure-sbindir.patch \ - file://runuser.pamd \ - file://runuser-l.pamd \ - ${OLDHOST} \ - file://ptest.patch \ - file://run-ptest \ - file://display_testname_for_subtest.patch \ - file://avoid_parallel_tests.patch \ -" -SRC_URI[md5sum] = "e0d8a25853f88cd15ff557e5d8cb4ea7" -SRC_URI[sha256sum] = "6c7397abc764e32e8159c2e96042874a190303e77adceb4ac5bd502a272a4734" - -CACHED_CONFIGUREVARS += "scanf_cv_alloc_modifier=ms" - -EXTRA_OECONF_class-native = "${SHARED_EXTRA_OECONF} \ - --disable-fallocate \ - --disable-use-tty-group \ -" -EXTRA_OECONF_class-nativesdk = "${SHARED_EXTRA_OECONF} \ - --disable-fallocate \ - --disable-use-tty-group \ -" diff --git a/poky/meta/recipes-devtools/binutils/binutils-2.30.inc b/poky/meta/recipes-devtools/binutils/binutils-2.30.inc index 37243db1b..35d7d9b93 100644 --- a/poky/meta/recipes-devtools/binutils/binutils-2.30.inc +++ b/poky/meta/recipes-devtools/binutils/binutils-2.30.inc @@ -47,6 +47,7 @@ SRC_URI = "\ file://CVE-2018-10372.patch \ file://CVE-2018-10535.patch \ file://CVE-2018-10534.patch \ + file://0001-Change-the-ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch \ " S = "${WORKDIR}/git" diff --git a/poky/meta/recipes-devtools/binutils/binutils/0001-Change-the-ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch b/poky/meta/recipes-devtools/binutils/binutils/0001-Change-the-ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch new file mode 100644 index 000000000..8604e678d --- /dev/null +++ b/poky/meta/recipes-devtools/binutils/binutils/0001-Change-the-ARM-assembler-s-ADR-and-ADRl-pseudo-ops-s.patch @@ -0,0 +1,176 @@ +From fc6141f097056f830a412afebed8d81a9d72b696 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Wed, 20 Jun 2018 12:38:10 +0100 +Subject: [PATCH] Change the ARM assembler's ADR and ADRl pseudo-ops so that + they will only set the bottom bit of imported thumb function symbols if the + -mthumb-interwork option is active. + +For more information see the email thread starting here: +https://www.sourceware.org/ml/binutils/2018-05/msg00348.html + + PR 21458 + * tc-arm.c (do_adr): Only set the bottom bit of an imported thumb + function symbol address if -mthumb-interwork is active. + (do_adrl): Likewise. + * doc/c-arm.texi: Update descriptions of the -mthumb-interwork + option and the ADR and ADRL pseudo-ops. + * NEWS: Mention the new behaviour of the ADR and ADRL pseudo-ops. + * testsuite/gas/arm/pr21458.d: Add -mthumb-interwork option to + assembler command line. + * testsuite/gas/arm/adr.d: Likewise. + * testsuite/gas/arm/adrl.d: Likewise. +--- + gas/ChangeLog | 14 ++++++++++++++ + gas/NEWS | 4 ++++ + gas/config/tc-arm.c | 10 ++++++---- + gas/doc/c-arm.texi | 17 ++++++++++++++++- + gas/testsuite/gas/arm/adr.d | 1 + + gas/testsuite/gas/arm/adrl.d | 1 + + gas/testsuite/gas/arm/pr21458.d | 3 ++- + 7 files changed, 44 insertions(+), 6 deletions(-) + +Index: git/gas/config/tc-arm.c +=================================================================== +--- git.orig/gas/config/tc-arm.c ++++ git/gas/config/tc-arm.c +@@ -8410,11 +8410,12 @@ do_adr (void) + inst.reloc.pc_rel = 1; + inst.reloc.exp.X_add_number -= 8; + +- if (inst.reloc.exp.X_op == O_symbol ++ if (support_interwork ++ && inst.reloc.exp.X_op == O_symbol + && inst.reloc.exp.X_add_symbol != NULL + && S_IS_DEFINED (inst.reloc.exp.X_add_symbol) + && THUMB_IS_FUNC (inst.reloc.exp.X_add_symbol)) +- inst.reloc.exp.X_add_number += 1; ++ inst.reloc.exp.X_add_number |= 1; + } + + /* This is a pseudo-op of the form "adrl rd, label" to be converted +@@ -8434,11 +8435,12 @@ do_adrl (void) + inst.size = INSN_SIZE * 2; + inst.reloc.exp.X_add_number -= 8; + +- if (inst.reloc.exp.X_op == O_symbol ++ if (support_interwork ++ && inst.reloc.exp.X_op == O_symbol + && inst.reloc.exp.X_add_symbol != NULL + && S_IS_DEFINED (inst.reloc.exp.X_add_symbol) + && THUMB_IS_FUNC (inst.reloc.exp.X_add_symbol)) +- inst.reloc.exp.X_add_number += 1; ++ inst.reloc.exp.X_add_number |= 1; + } + + static void +Index: git/gas/doc/c-arm.texi +=================================================================== +--- git.orig/gas/doc/c-arm.texi ++++ git/gas/doc/c-arm.texi +@@ -317,7 +317,8 @@ instructions; that is, it should behave + @cindex @code{-mthumb-interwork} command line option, ARM + @item -mthumb-interwork + This option specifies that the output generated by the assembler should +-be marked as supporting interworking. ++be marked as supporting interworking. It also affects the behaviour ++of the @code{ADR} and @code{ADRL} pseudo opcodes. + + @cindex @code{-mimplicit-it} command line option, ARM + @item -mimplicit-it=never +@@ -1060,6 +1061,16 @@ out of range, or if it is not defined in + the ADR instruction, then an error will be generated. This instruction + will not make use of the literal pool. + ++If @var{label} is a thumb function symbol, and thumb interworking has ++been enabled via the @option{-mthumb-interwork} option then the bottom ++bit of the value stored into @var{register} will be set. This allows ++the following sequence to work as expected: ++ ++@smallexample ++ adr r0, thumb_function ++ blx r0 ++@end smallexample ++ + @cindex @code{ADRL reg,