cmake: Fix CVE-2024-9681.patch and CVE-2024-9681.patch

microsoft · Jan 22, 2025 · adde4c9 · adde4c9
1 parent fa62dba
commit adde4c9
Show file tree

Hide file tree

Showing 4 changed files with 230 additions and 1 deletion.
diff --git a/SPECS/cmake/CVE-2024-7264.patch b/SPECS/cmake/CVE-2024-7264.patch
@@ -0,0 +1,102 @@
+From dc1799f4155da692a8d88a337ee83ede7926bfde Mon Sep 17 00:00:00 2001
+From: jykanase <[email protected]>
+Date: Tue, 21 Jan 2025 08:53:58 +0000
+Subject: [PATCH] CVE-2024-7264
+
+Source Link : https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519
+---
+ Utilities/cmcurl/lib/vtls/x509asn1.c | 32 +++++++++++++++++++++-------
+ Utilities/cmcurl/lib/vtls/x509asn1.h | 11 ++++++++++
+ 2 files changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c
+index 64313a9d..b5412c50 100644
+--- a/Utilities/cmcurl/lib/vtls/x509asn1.c
++++ b/Utilities/cmcurl/lib/vtls/x509asn1.c
+@@ -515,12 +515,13 @@ static CURLcode GTime2str(struct dynbuf *store,
+   fracl = 0; /* no fractional seconds detected so far */
+   if(fracp < end && (*fracp == '.' || *fracp == ',')) {
+     /* Have fractional seconds, e.g. "[.,]\d+". How many? */
+-    tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
++    fracp++; /* should be a digit char or BAD ARGUMENT */
++    tzp = fracp;
+     while(tzp < end && ISDIGIT(*tzp))
+       tzp++;
+     if(tzp == fracp) /* never looped, no digit after [.,] */
+       return CURLE_BAD_FUNCTION_ARGUMENT;
+-    fracl = tzp - fracp - 1; /* number of fractional sec digits */
++    fracl = tzp - fracp; /* number of fractional sec digits */
+     DEBUGASSERT(fracl > 0);
+     /* Strip trailing zeroes in fractional seconds.
+      * May reduce fracl to 0 if only '0's are present. */
+@@ -529,18 +530,24 @@ static CURLcode GTime2str(struct dynbuf *store,
+   }
+
+   /* Process timezone. */
+-  if(tzp >= end)
+-    ;           /* Nothing to do. */
++  if(tzp >= end) {
++    tzp = "";
++    tzl = 0;
++  }
+   else if(*tzp == 'Z') {
+-    tzp = " GMT";
+-    end = tzp + 4;
++    sep = " ";
++    tzp = "GMT";
++    tzl = 3;
++  }
++  else if((*tzp == '+') || (*tzp == '-')) {
++    sep = " UTC";
++    tzl = end - tzp;
+   }
+   else {
+     sep = " ";
+-    tzp++;
++    tzl = end - tzp;
+   }
+
+-  tzl = end - tzp;
+   return Curl_dyn_addf(store,
+                        "%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
+                        beg, beg + 4, beg + 6,
+@@ -549,6 +556,15 @@ static CURLcode GTime2str(struct dynbuf *store,
+                        sep, (int)tzl, tzp);
+ }
+
++#ifdef UNITTESTS
++/* used by unit1656.c */
++CURLcode Curl_x509_GTime2str(struct dynbuf *store,
++                             const char *beg, const char *end)
++{
++  return GTime2str(store, beg, end);
++}
++#endif
++
+ /*
+  * Convert an ASN.1 UTC time to a printable string.
+  *
+diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.h b/Utilities/cmcurl/lib/vtls/x509asn1.h
+index 23a67b82..1d8bbabc 100644
+--- a/Utilities/cmcurl/lib/vtls/x509asn1.h
++++ b/Utilities/cmcurl/lib/vtls/x509asn1.h
+@@ -76,5 +76,16 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
+                                const char *beg, const char *end);
+ CURLcode Curl_verifyhost(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          const char *beg, const char *end);
++
++#ifdef UNITTESTS
++#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
++  defined(USE_MBEDTLS)
++
++/* used by unit1656.c */
++CURLcode Curl_x509_GTime2str(struct dynbuf *store,
++                             const char *beg, const char *end);
++#endif
++#endif
++
+ #endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP */
+ #endif /* HEADER_CURL_X509ASN1_H */
+-- 
+2.45.2
+
diff --git a/SPECS/cmake/CVE-2024-9681.patch b/SPECS/cmake/CVE-2024-9681.patch
@@ -0,0 +1,64 @@
+From 62c0d5d5862df10ac671f5a94d49d30ec025aae2 Mon Sep 17 00:00:00 2001
+From: jykanase <[email protected]>
+Date: Tue, 21 Jan 2025 11:57:45 +0000
+Subject: [PATCH] CVE-2024-9681.patch
+
+Backported form: https://github.com/curl/curl/commit/a94973805df96269bf
+---
+ Utilities/cmcurl/lib/hsts.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Utilities/cmcurl/lib/hsts.c b/Utilities/cmcurl/lib/hsts.c
+index a5e76761..d1e434f2 100644
+--- a/Utilities/cmcurl/lib/hsts.c
++++ b/Utilities/cmcurl/lib/hsts.c
+@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
+ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
+                            bool subdomain)
+ {
++  struct stsentry *bestsub = NULL;
+   if(h) {
+     char buffer[MAX_HSTS_HOSTLEN + 1];
+     time_t now = time(NULL);
+     size_t hlen = strlen(hostname);
+     struct Curl_llist_element *e;
+     struct Curl_llist_element *n;
++    size_t blen = 0;
+
+     if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
+       return NULL;
+@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
+         if(ntail < hlen) {
+           size_t offs = hlen - ntail;
+           if((hostname[offs-1] == '.') &&
+-             strncasecompare(&hostname[offs], sts->host, ntail))
+-            return sts;
++             strncasecompare(&hostname[offs], sts->host, ntail) &&
++             (ntail > blen)) {
++            /* save the tail match with the longest tail */
++            bestsub = sts;
++            blen = ntail;
++          }
+         }
+       }
+       if(strcasecompare(hostname, sts->host))
+         return sts;
+     }
+   }
+-  return NULL; /* no match */
++  return bestsub;
+ }
+
+ /*
+@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line)
+     e = Curl_hsts(h, p, subdomain);
+     if(!e)
+       result = hsts_create(h, p, subdomain, expires);
+-    else {
++    else if(strcasecompare(p, e->host)) {
+       /* the same host name, use the largest expire time */
+       if(expires > e->expires)
+         e->expires = expires;
+-- 
+2.45.2
+
diff --git a/SPECS/cmake/clean-up-GTime2str.patch b/SPECS/cmake/clean-up-GTime2str.patch
@@ -0,0 +1,57 @@
+From f32356460b128194382ab8178a5024ad1b3cf064 Mon Sep 17 00:00:00 2001
+From: jykanase <[email protected]>
+Date: Tue, 21 Jan 2025 08:46:01 +0000
+Subject: [PATCH] clean up GTime2str
+
+Source Link: https://github.com/curl/curl/commit/3c914bc680155b32178f1f15ca8d47c7f4640afe
+---
+ Utilities/cmcurl/lib/vtls/x509asn1.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c
+index ed84032a..64313a9d 100644
+--- a/Utilities/cmcurl/lib/vtls/x509asn1.c
++++ b/Utilities/cmcurl/lib/vtls/x509asn1.c
+@@ -491,7 +491,7 @@ static CURLcode GTime2str(struct dynbuf *store,
+   /* Convert an ASN.1 Generalized time to a printable string.
+      Return the dynamically allocated string, or NULL if an error occurs. */
+
+-  for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
++  for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
+     ;
+
+   /* Get seconds digits. */
+@@ -510,17 +510,22 @@ static CURLcode GTime2str(struct dynbuf *store,
+     return CURLE_BAD_FUNCTION_ARGUMENT;
+   }
+
+-  /* Scan for timezone, measure fractional seconds. */
++  /* timezone follows optional fractional seconds. */
+   tzp = fracp;
+-  fracl = 0;
++  fracl = 0; /* no fractional seconds detected so far */
+   if(fracp < end && (*fracp == '.' || *fracp == ',')) {
+-    fracp++;
+-    do
++    /* Have fractional seconds, e.g. "[.,]\d+". How many? */
++    tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
++    while(tzp < end && ISDIGIT(*tzp))
+       tzp++;
+-    while(tzp < end && *tzp >= '0' && *tzp <= '9');
+-    /* Strip leading zeroes in fractional seconds. */
+-    for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
+-      ;
++    if(tzp == fracp) /* never looped, no digit after [.,] */
++      return CURLE_BAD_FUNCTION_ARGUMENT;
++    fracl = tzp - fracp - 1; /* number of fractional sec digits */
++    DEBUGASSERT(fracl > 0);
++    /* Strip trailing zeroes in fractional seconds.
++     * May reduce fracl to 0 if only '0's are present. */
++    while(fracl && fracp[fracl - 1] == '0')
++      fracl--;
+   }
+
+   /* Process timezone. */
+-- 
+2.45.2
+
diff --git a/SPECS/cmake/cmake.spec b/SPECS/cmake/cmake.spec
@@ -2,7 +2,7 @@
 Summary:        Cmake
 Name:           cmake
 Version:        3.30.3
-Release:        3%{?dist}
+Release:        4%{?dist}
 License:        BSD AND LGPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -15,6 +15,9 @@ Patch1:         CVE-2024-6197.patch
 Patch2:         CVE-2024-6874.patch
 Patch3:         CVE-2024-8096.patch
 Patch4:         CVE-2024-11053.patch
+Patch5:         clean-up-GTime2str.patch
+Patch6:         CVE-2024-7264.patch
+Patch7:         CVE-2024-9681.patch
 BuildRequires:  bzip2
 BuildRequires:  bzip2-devel
 BuildRequires:  curl
@@ -94,6 +97,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
 %{_libdir}/rpm/macros.d/macros.cmake
 
 %changelog
+* Tue Jan 22 2025 Jyoti Kanase <[email protected]> - 3.30.3-4
+- Fix CVE-2024-9681 and CVE-2024-9681
+
 * Wed Jan 15 2025 Henry Beberman <[email protected]> - 3.30.3-3
 - Patch vendored curl for CVE-2024-11053