mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-30 12:29:55 +00:00
Code Issues Projects Releases Wiki Activity

busybox: Patch CVE-2023-42363

Browse Source 
Backport patch for CVE-2023-42363.

(From OE-Core rev: 9c52dadd06fd9132c6efc1d06b6fc4a4517be6c3)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 814f97922e1d6c24a36b03ee0e865f2210ff6d7c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2024-07-12 23:38:54 +02:00
committed by Steve Sakoman
parent 8469d3c7d7
commit bdb92a57ea
2 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/busybox/busybox/CVE-2023-42363.patch
+67
View File
@@ -0,0 +1,67 @@
From fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 20 May 2024 17:55:28 +0200
Subject: [PATCH] awk: fix use after free (CVE-2023-42363)
function old new delta
evaluate 3377 3385 +8
Fixes https://bugs.busybox.net/show_bug.cgi?id=15865
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
CVE: CVE-2023-42363
Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
editors/awk.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/editors/awk.c b/editors/awk.c
index 0981c6735..ff6d6350b 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -2910,19 +2910,14 @@ static var *evaluate(node *op, var *res)
/* yes, remember where Fields[] is */
old_Fields_ptr = Fields;
}
- if (opinfo & OF_STR1) {
- L.s = getvar_s(L.v);
- debug_printf_eval("L.s:'%s'\n", L.s);
- }
if (opinfo & OF_NUM1) {
L_d = getvar_i(L.v);
debug_printf_eval("L_d:%f\n", L_d);
}
}
- /* NB: Must get string/numeric values of L (done above)
- * _before_ evaluate()'ing R.v: if both L and R are $NNNs,
- * and right one is large, then L.v points to Fields[NNN1],
- * second evaluate() reallocates and moves (!) Fields[],
+ /* NB: if both L and R are $NNNs, and right one is large,
+ * then at this pint L.v points to Fields[NNN1], second
+ * evaluate() below reallocates and moves (!) Fields[],
* R.v points to Fields[NNN2] but L.v now points to freed mem!
* (Seen trying to evaluate "$444 $44444")
*/
@@ -2942,6 +2937,16 @@ static var *evaluate(node *op, var *res)
debug_printf_eval("R.s:'%s'\n", R.s);
}
}
+ /* Get L.s _after_ R.v is evaluated: it may have realloc'd L.v
+ * so we must get the string after "old_Fields_ptr" correction
+ * above. Testcase: x = (v = "abc", gsub("b", "X", v));
+ */
+ if (opinfo & OF_RES1) {
+ if (opinfo & OF_STR1) {
+ L.s = getvar_s(L.v);
+ debug_printf_eval("L.s:'%s'\n", L.s);
+ }
+ }
debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
switch (XC(opinfo & OPCLSMASK)) {
--
2.30.2
meta/recipes-core/busybox/busybox_1.36.1.bb
+1
View File
@@ -52,6 +52,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
file://start-stop-false.patch \ file://start-stop-false.patch \
file://CVE-2021-42380.patch \ file://CVE-2021-42380.patch \
file://0001-awk-fix-segfault-when-compiled-by-clang.patch \ file://0001-awk-fix-segfault-when-compiled-by-clang.patch \
file://CVE-2023-42363.patch \
" "
SRC_URI:append:libc-musl = " file://musl.cfg " SRC_URI:append:libc-musl = " file://musl.cfg "
# TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html # TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html