[OE-core][hardknott][PATCH] go: fix CVE-2021-38297

* [OE-core][hardknott][PATCH] go: fix CVE-2021-38297
@ 2021-11-24 19:15 Trevor Gamblin
  0 siblings, 0 replies; 2+ messages in thread
From: Trevor Gamblin @ 2021-11-24 19:15 UTC (permalink / raw)
  To: openembedded-core

Backport a fix from 1.16.10 to address CVE-2021-38297.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
---
 meta/recipes-devtools/go/go-1.16.8.inc        |  1 +
 ...nk-do-not-let-command-line-args-over.patch | 95 +++++++++++++++++++
 2 files changed, 96 insertions(+)
 create mode 100644 meta/recipes-devtools/go/go-1.16/0001-misc-wasm-cmd-link-do-not-let-command-line-args-over.patch

diff --git a/meta/recipes-devtools/go/go-1.16.8.inc b/meta/recipes-devtools/go/go-1.16.8.inc
index acc2300a286..31dc066845b 100644
--- a/meta/recipes-devtools/go/go-1.16.8.inc
+++ b/meta/recipes-devtools/go/go-1.16.8.inc
@@ -17,6 +17,7 @@ SRC_URI += "\
     file://0008-use-GOBUILDMODE-to-set-buildmode.patch \
     file://0009-Revert-cmd-go-make-sure-CC-and-CXX-are-absolute.patch \
     file://0001-encoding-xml-handle-leading-trailing-or-double-colon.patch \
+    file://0001-misc-wasm-cmd-link-do-not-let-command-line-args-over.patch \
 "
 SRC_URI[main.sha256sum] = "8f2a8c24b793375b3243df82fdb0c8387486dcc8a892ca1c991aa99ace086b98"
 
diff --git a/meta/recipes-devtools/go/go-1.16/0001-misc-wasm-cmd-link-do-not-let-command-line-args-over.patch b/meta/recipes-devtools/go/go-1.16/0001-misc-wasm-cmd-link-do-not-let-command-line-args-over.patch
new file mode 100644
index 00000000000..21b82c0c9fe
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.16/0001-misc-wasm-cmd-link-do-not-let-command-line-args-over.patch
@@ -0,0 +1,95 @@
+From 77f2750f4398990eed972186706f160631d7dae4 Mon Sep 17 00:00:00 2001
+From: Cherry Mui <cherryyz@google.com>
+Date: Thu, 2 Sep 2021 16:51:59 -0400
+Subject: [PATCH] misc/wasm, cmd/link: do not let command line args overwrite
+ global data
+
+On Wasm, wasm_exec.js puts command line arguments at the beginning
+of the linear memory (following the "zero page"). Currently there
+is no limit for this, and a very long command line can overwrite
+the program's data section. Prevent this by limiting the command
+line to 4096 bytes, and in the linker ensuring the data section
+starts at a high enough address (8192).
+
+(Arguably our address assignment on Wasm is a bit confusing. This
+is the minimum fix I can come up with.)
+
+Thanks to Ben Lubar for reporting this issue.
+
+Fixes #48797
+Fixes CVE-2021-38297
+
+Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-by: Than McIntosh <thanm@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/354571
+Reviewed-by: Cherry Mui <cherryyz@google.com>
+Reviewed-by: Heschi Kreinick <heschi@google.com>
+Trust: Michael Knyszek <mknyszek@google.com>
+Run-TryBot: Michael Knyszek <mknyszek@google.com>
+TryBot-Result: Go Bot <gobot@golang.org>
+
+Upstream-Status: Backport (https://github.com/golang/go/commit/77f2750f4398990eed972186706f160631d7dae4)
+
+CVE: CVE-2021-38297
+
+Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
+---
+ misc/wasm/wasm_exec.js           |  7 +++++++
+ src/cmd/link/internal/ld/data.go | 11 ++++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/misc/wasm/wasm_exec.js b/misc/wasm/wasm_exec.js
+index 82041e6bb9..a0a264278b 100644
+--- a/misc/wasm/wasm_exec.js
++++ b/misc/wasm/wasm_exec.js
+@@ -564,6 +564,13 @@
+ 				offset += 8;
+ 			});
+ 
++			// The linker guarantees global data starts from at least wasmMinDataAddr.
++			// Keep in sync with cmd/link/internal/ld/data.go:wasmMinDataAddr.
++			const wasmMinDataAddr = 4096 + 4096;
++			if (offset >= wasmMinDataAddr) {
++				throw new Error("command line too long");
++			}
++
+ 			this._inst.exports.run(argc, argv);
+ 			if (this.exited) {
+ 				this._resolveExitPromise();
+diff --git a/src/cmd/link/internal/ld/data.go b/src/cmd/link/internal/ld/data.go
+index 52035e9630..54a1d188cd 100644
+--- a/src/cmd/link/internal/ld/data.go
++++ b/src/cmd/link/internal/ld/data.go
+@@ -2330,6 +2330,11 @@ func assignAddress(ctxt *Link, sect *sym.Section, n int, s loader.Sym, va uint64
+ 	return sect, n, va
+ }
+ 
++// On Wasm, we reserve 4096 bytes for zero page, then 4096 bytes for wasm_exec.js
++// to store command line args. Data sections starts from at least address 8192.
++// Keep in sync with wasm_exec.js.
++const wasmMinDataAddr = 4096 + 4096
++
+ // address assigns virtual addresses to all segments and sections and
+ // returns all segments in file order.
+ func (ctxt *Link) address() []*sym.Segment {
+@@ -2339,10 +2344,14 @@ func (ctxt *Link) address() []*sym.Segment {
+ 	order = append(order, &Segtext)
+ 	Segtext.Rwx = 05
+ 	Segtext.Vaddr = va
+-	for _, s := range Segtext.Sections {
++	for i, s := range Segtext.Sections {
+ 		va = uint64(Rnd(int64(va), int64(s.Align)))
+ 		s.Vaddr = va
+ 		va += s.Length
++
++		if ctxt.IsWasm() && i == 0 && va < wasmMinDataAddr {
++			va = wasmMinDataAddr
++		}
+ 	}
+ 
+ 	Segtext.Length = va - uint64(*FlagTextAddr)
+-- 
+2.33.0
+
-- 
2.33.0



^ permalink raw reply related	[flat|nested] 2+ messages in thread