Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Medium] cmake: Fix CVE-2024-7264 and CVE-2024-9681 #12020

Open
wants to merge 2 commits into
base: fasttrack/3.0
Choose a base branch
from
+234 −5
Open

[Medium] cmake: Fix CVE-2024-7264 and CVE-2024-9681 #12020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d26af0e
cmake: Fix CVE-2024-7264 and CVE-2024-9681
jykanase Jan 22, 2025
0becd14
Updated toolchain_aarch64.txt & toolchain_x86_64.txt
jykanase Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions SPECS/cmake/CVE-2024-7264.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
From dc1799f4155da692a8d88a337ee83ede7926bfde Mon Sep 17 00:00:00 2001
From: jykanase <[email protected]>
Date: Tue, 21 Jan 2025 08:53:58 +0000
Subject: [PATCH] CVE-2024-7264

Source Link : https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519
---
Utilities/cmcurl/lib/vtls/x509asn1.c | 32 +++++++++++++++++++++-------
Utilities/cmcurl/lib/vtls/x509asn1.h | 11 ++++++++++
2 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c
index 64313a9d..b5412c50 100644
--- a/Utilities/cmcurl/lib/vtls/x509asn1.c
+++ b/Utilities/cmcurl/lib/vtls/x509asn1.c
@@ -515,12 +515,13 @@ static CURLcode GTime2str(struct dynbuf *store,
fracl = 0; /* no fractional seconds detected so far */
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
/* Have fractional seconds, e.g. "[.,]\d+". How many? */
- tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
+ fracp++; /* should be a digit char or BAD ARGUMENT */
+ tzp = fracp;
while(tzp < end && ISDIGIT(*tzp))
tzp++;
if(tzp == fracp) /* never looped, no digit after [.,] */
return CURLE_BAD_FUNCTION_ARGUMENT;
- fracl = tzp - fracp - 1; /* number of fractional sec digits */
+ fracl = tzp - fracp; /* number of fractional sec digits */
DEBUGASSERT(fracl > 0);
/* Strip trailing zeroes in fractional seconds.
* May reduce fracl to 0 if only '0's are present. */
@@ -529,18 +530,24 @@ static CURLcode GTime2str(struct dynbuf *store,
}

/* Process timezone. */
- if(tzp >= end)
- ; /* Nothing to do. */
+ if(tzp >= end) {
+ tzp = "";
+ tzl = 0;
+ }
else if(*tzp == 'Z') {
- tzp = " GMT";
- end = tzp + 4;
+ sep = " ";
+ tzp = "GMT";
+ tzl = 3;
+ }
+ else if((*tzp == '+') || (*tzp == '-')) {
+ sep = " UTC";
+ tzl = end - tzp;
}
else {
sep = " ";
- tzp++;
+ tzl = end - tzp;
}

- tzl = end - tzp;
return Curl_dyn_addf(store,
"%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
beg, beg + 4, beg + 6,
@@ -549,6 +556,15 @@ static CURLcode GTime2str(struct dynbuf *store,
sep, (int)tzl, tzp);
}

+#ifdef UNITTESTS
+/* used by unit1656.c */
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
+ const char *beg, const char *end)
+{
+ return GTime2str(store, beg, end);
+}
+#endif
+
/*
* Convert an ASN.1 UTC time to a printable string.
*
diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.h b/Utilities/cmcurl/lib/vtls/x509asn1.h
index 23a67b82..1d8bbabc 100644
--- a/Utilities/cmcurl/lib/vtls/x509asn1.h
+++ b/Utilities/cmcurl/lib/vtls/x509asn1.h
@@ -76,5 +76,16 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
const char *beg, const char *end);
CURLcode Curl_verifyhost(struct Curl_cfilter *cf, struct Curl_easy *data,
const char *beg, const char *end);
+
+#ifdef UNITTESTS
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
+ defined(USE_MBEDTLS)
+
+/* used by unit1656.c */
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
+ const char *beg, const char *end);
+#endif
+#endif
+
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP */
#endif /* HEADER_CURL_X509ASN1_H */
--
2.45.2

64 changes: 64 additions & 0 deletions SPECS/cmake/CVE-2024-9681.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
From 62c0d5d5862df10ac671f5a94d49d30ec025aae2 Mon Sep 17 00:00:00 2001
From: jykanase <[email protected]>
Date: Tue, 21 Jan 2025 11:57:45 +0000
Subject: [PATCH] CVE-2024-9681.patch

Backported form: https://github.com/curl/curl/commit/a94973805df96269bf
---
Utilities/cmcurl/lib/hsts.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/Utilities/cmcurl/lib/hsts.c b/Utilities/cmcurl/lib/hsts.c
index a5e76761..d1e434f2 100644
--- a/Utilities/cmcurl/lib/hsts.c
+++ b/Utilities/cmcurl/lib/hsts.c
@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
bool subdomain)
{
+ struct stsentry *bestsub = NULL;
if(h) {
char buffer[MAX_HSTS_HOSTLEN + 1];
time_t now = time(NULL);
size_t hlen = strlen(hostname);
struct Curl_llist_element *e;
struct Curl_llist_element *n;
+ size_t blen = 0;

if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
return NULL;
@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
if(ntail < hlen) {
size_t offs = hlen - ntail;
if((hostname[offs-1] == '.') &&
- strncasecompare(&hostname[offs], sts->host, ntail))
- return sts;
+ strncasecompare(&hostname[offs], sts->host, ntail) &&
+ (ntail > blen)) {
+ /* save the tail match with the longest tail */
+ bestsub = sts;
+ blen = ntail;
+ }
}
}
if(strcasecompare(hostname, sts->host))
return sts;
}
}
- return NULL; /* no match */
+ return bestsub;
}

/*
@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line)
e = Curl_hsts(h, p, subdomain);
if(!e)
result = hsts_create(h, p, subdomain, expires);
- else {
+ else if(strcasecompare(p, e->host)) {
/* the same host name, use the largest expire time */
if(expires > e->expires)
e->expires = expires;
--
2.45.2

57 changes: 57 additions & 0 deletions SPECS/cmake/clean-up-GTime2str.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
From f32356460b128194382ab8178a5024ad1b3cf064 Mon Sep 17 00:00:00 2001
From: jykanase <[email protected]>
Date: Tue, 21 Jan 2025 08:46:01 +0000
Subject: [PATCH] clean up GTime2str

Source Link: https://github.com/curl/curl/commit/3c914bc680155b32178f1f15ca8d47c7f4640afe
---
Utilities/cmcurl/lib/vtls/x509asn1.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c
index ed84032a..64313a9d 100644
--- a/Utilities/cmcurl/lib/vtls/x509asn1.c
+++ b/Utilities/cmcurl/lib/vtls/x509asn1.c
@@ -491,7 +491,7 @@ static CURLcode GTime2str(struct dynbuf *store,
/* Convert an ASN.1 Generalized time to a printable string.
Return the dynamically allocated string, or NULL if an error occurs. */

- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
+ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
;

/* Get seconds digits. */
@@ -510,17 +510,22 @@ static CURLcode GTime2str(struct dynbuf *store,
return CURLE_BAD_FUNCTION_ARGUMENT;
}

- /* Scan for timezone, measure fractional seconds. */
+ /* timezone follows optional fractional seconds. */
tzp = fracp;
- fracl = 0;
+ fracl = 0; /* no fractional seconds detected so far */
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
- fracp++;
- do
+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
+ tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
+ while(tzp < end && ISDIGIT(*tzp))
tzp++;
- while(tzp < end && *tzp >= '0' && *tzp <= '9');
- /* Strip leading zeroes in fractional seconds. */
- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
- ;
+ if(tzp == fracp) /* never looped, no digit after [.,] */
+ return CURLE_BAD_FUNCTION_ARGUMENT;
+ fracl = tzp - fracp - 1; /* number of fractional sec digits */
+ DEBUGASSERT(fracl > 0);
+ /* Strip trailing zeroes in fractional seconds.
+ * May reduce fracl to 0 if only '0's are present. */
+ while(fracl && fracp[fracl - 1] == '0')
+ fracl--;
}

/* Process timezone. */
--
2.45.2

8 changes: 7 additions & 1 deletion SPECS/cmake/cmake.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Summary: Cmake
Name: cmake
Version: 3.30.3
Release: 3%{?dist}
Release: 4%{?dist}
License: BSD AND LGPLv2+
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -15,6 +15,9 @@ Patch1: CVE-2024-6197.patch
Patch2: CVE-2024-6874.patch
Patch3: CVE-2024-8096.patch
Patch4: CVE-2024-11053.patch
Patch5: clean-up-GTime2str.patch
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jykanase what is patch5 doing? Is it related to a CVE fix or just some additional change that was brought over?

Copy link
Contributor Author

@jykanase jykanase Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is related to CVE-2024-7264. Some changes were required in the same file to apply CVE patch cleanly.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jykanase Our preference in these situations is to simply combine it with the CVE fixing patch file.

Patch6: CVE-2024-7264.patch
Patch7: CVE-2024-9681.patch
BuildRequires: bzip2
BuildRequires: bzip2-devel
BuildRequires: curl
Expand Down Expand Up @@ -94,6 +97,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
%{_libdir}/rpm/macros.d/macros.cmake

%changelog
* Tue Jan 22 2025 Jyoti Kanase <[email protected]> - 3.30.3-4
- Fix CVE-2024-7264 and CVE-2024-9681

* Wed Jan 15 2025 Henry Beberman <[email protected]> - 3.30.3-3
- Patch vendored curl for CVE-2024-11053

Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
chkconfig-1.25-1.azl3.aarch64.rpm
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
chkconfig-lang-1.25-1.azl3.aarch64.rpm
cmake-3.30.3-3.azl3.aarch64.rpm
cmake-debuginfo-3.30.3-3.azl3.aarch64.rpm
cmake-3.30.3-4.azl3.aarch64.rpm
cmake-debuginfo-3.30.3-4.azl3.aarch64.rpm
coreutils-9.4-6.azl3.aarch64.rpm
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
coreutils-lang-9.4-6.azl3.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
chkconfig-1.25-1.azl3.x86_64.rpm
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
chkconfig-lang-1.25-1.azl3.x86_64.rpm
cmake-3.30.3-3.azl3.x86_64.rpm
cmake-debuginfo-3.30.3-3.azl3.x86_64.rpm
cmake-3.30.3-4.azl3.x86_64.rpm
cmake-debuginfo-3.30.3-4.azl3.x86_64.rpm
coreutils-9.4-6.azl3.x86_64.rpm
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
coreutils-lang-9.4-6.azl3.x86_64.rpm
Expand Down
Loading