From 214b973fbd8dd44f488aacd0c17619b7d890e1d8 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Mon, 26 Jun 2023 11:49:14 +0530 Subject: [PATCH] libcap: CVE-2023-2602 Memory Leak on pthread_create() Error Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb (From OE-Core rev: 7e4f3c51c0bac772bf56f69a3c065b2b2d095335) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman --- .../libcap/files/CVE-2023-2602.patch | 45 +++++++++++++++++++ meta/recipes-support/libcap/libcap_2.66.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2602.patch diff --git a/meta/recipes-support/libcap/files/CVE-2023-2602.patch b/meta/recipes-support/libcap/files/CVE-2023-2602.patch new file mode 100644 index 0000000000..1ad5aeb826 --- /dev/null +++ b/meta/recipes-support/libcap/files/CVE-2023-2602.patch @@ -0,0 +1,45 @@ +From bc6b36682f188020ee4770fae1d41bde5b2c97bb Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" +Date: Wed, 3 May 2023 19:18:36 -0700 +Subject: Correct the check of pthread_create()'s return value. + +This function returns a positive number (errno) on error, so the code +wasn't previously freeing some memory in this situation. + +Discussion: + + https://stackoverflow.com/a/3581020/14760867 + +Credit for finding this bug in libpsx goes to David Gstir of +X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security +audit of the libcap source code in April of 2023. The audit +was sponsored by the Open Source Technology Improvement Fund +(https://ostif.org/). + +Audit ref: LCAP-CR-23-01 (CVE-2023-2602) + +Signed-off-by: Andrew G. Morgan + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb] +CVE: CVE-2023-2602 +Signed-off-by: Hitendra Prajapati +--- + psx/psx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/psx/psx.c b/psx/psx.c +index d9c0485..65eb2aa 100644 +--- a/psx/psx.c ++++ b/psx/psx.c +@@ -516,7 +516,7 @@ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr, + pthread_sigmask(SIG_BLOCK, &sigbit, NULL); + + int ret = __real_pthread_create(thread, attr, _psx_start_fn, starter); +- if (ret == -1) { ++ if (ret > 0) { + psx_new_state(_PSX_CREATE, _PSX_IDLE); + memset(starter, 0, sizeof(*starter)); + free(starter); +-- +2.25.1 + diff --git a/meta/recipes-support/libcap/libcap_2.66.bb b/meta/recipes-support/libcap/libcap_2.66.bb index c50e9d8cc7..d3189fb105 100644 --- a/meta/recipes-support/libcap/libcap_2.66.bb +++ b/meta/recipes-support/libcap/libcap_2.66.bb @@ -16,6 +16,7 @@ DEPENDS = "hostperl-runtime-native gperf-native" SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${PV}.tar.xz \ file://0001-ensure-the-XATTR_NAME_CAPS-is-defined-when-it-is-use.patch \ file://0002-tests-do-not-run-target-executables.patch \ + file://CVE-2023-2602.patch \ " SRC_URI:append:class-nativesdk = " \ file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \