* [hardknott] [PATCH 02/28] glibc: Add 8GB VM usage cap for usermode test suite
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 03/28] cups: whitelist CVE-2021-25317 Richard Purdie
` (25 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
We've noticed that:
MACHINE=qemuarm oe-selftest -r glibc.GlibcSelfTest.test_glibc
ends up with one process growing to about the size of system memory
and triggering the OOM killer. This has been taking out other builds
running on the system on the autobuilders and is one cause of our
intermittent failures.
This was tracked down to:
WORKDIR=XXX/tmp/work/armv7vet2hf-neon-poky-linux-gnueabi/glibc-testsuite/2.33-r0
BUILDDIR=$WORKDIR/build-arm-poky-linux-gnueabi QEMU_SYSROOT=$WORKDIR/recipe-sysroot
QEMU_OPTIONS="$WORKDIR/recipe-sysroot-native/usr/bin/qemu-arm -r 3.2.0" \
$WORKDIR/check-test-wrapper user env GCONV_PATH=$BUILDDIR/iconvdata LOCPATH=$BUILDDIR/localedata LC_ALL=C $BUILDDIR/elf/ld-linux-armhf.so.3 \
--library-path $BUILDDIR:$BUILDDIR/math:$BUILDDIR/elf:$BUILDDIR/dlfcn:$BUILDDIR/nss:$BUILDDIR/nis:$BUILDDIR/rt:$BUILDDIR/resolv:$BUILDDIR/mathvec:$BUILDDIR/support:$BUILDDIR/nptl \
$BUILDDIR/nptl/tst-pthread-timedlock-lockloop
although other glibc tests appear to use 16GB of memory before failing
anyway. By capping the VM size to 8GB, we see the same number of failures
but no OOM situations. There may be some issue in qemu or the test which
could be improved to avoid this entirely but this provides a necessary
and useful safeguard to other builds and doensn't appear to make the
situation worse.
On a loaded system OOM may not occur as the test timeout may be triggered
first. An experiment with a 5GB limit showed an additional 7 failures.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-core/glibc/glibc/check-test-wrapper | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/meta/recipes-core/glibc/glibc/check-test-wrapper b/meta/recipes-core/glibc/glibc/check-test-wrapper
index f8e04e02d21..6ec9b9b29eb 100644
--- a/meta/recipes-core/glibc/glibc/check-test-wrapper
+++ b/meta/recipes-core/glibc/glibc/check-test-wrapper
@@ -2,6 +2,7 @@
import sys
import os
import subprocess
+import resource
env = os.environ.copy()
args = sys.argv[1:]
@@ -44,6 +45,14 @@ if targettype == "user":
qemuargs += ["-L", sysroot]
qemuargs += ["-E", "LD_LIBRARY_PATH={}".format(":".join(libpaths))]
command = qemuargs + args
+
+ # We've seen qemu-arm using up all system memory for some glibc
+ # tests e.g. nptl/tst-pthread-timedlock-lockloop
+ # Cap at 8GB since no test should need more than that
+ # (5GB adds 7 failures for qemuarm glibc test run)
+ limit = 8*1024*1024*1024
+ resource.setrlimit(resource.RLIMIT_AS, (limit, limit))
+
elif targettype == "ssh":
host = os.environ.get("SSH_HOST", None)
user = os.environ.get("SSH_HOST_USER", None)
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 03/28] cups: whitelist CVE-2021-25317
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 02/28] glibc: Add 8GB VM usage cap for usermode test suite Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 04/28] sstate: Handle manifest 'corruption' issue Richard Purdie
` (24 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Ross Burton, Ross Burton
From: Ross Burton <ross@burtonini.com>
This CVE relates to bad ownership of /var/log/cups, which we don't have.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-extended/cups/cups.inc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-extended/cups/cups.inc b/meta/recipes-extended/cups/cups.inc
index 244c87001fe..beee6148284 100644
--- a/meta/recipes-extended/cups/cups.inc
+++ b/meta/recipes-extended/cups/cups.inc
@@ -127,3 +127,7 @@ SYSROOT_PREPROCESS_FUNCS += "cups_sysroot_preprocess"
cups_sysroot_preprocess () {
sed -i ${SYSROOT_DESTDIR}${bindir_crossscripts}/cups-config -e 's:cups_datadir=.*:cups_datadir=${datadir}/cups:' -e 's:cups_serverbin=.*:cups_serverbin=${libexecdir}/cups:'
}
+
+# -25317 concerns /var/log/cups having lp ownership. Our /var/log/cups is
+# root:root, so this doesn't apply.
+CVE_CHECK_WHITELIST += "CVE-2021-25317"
\ No newline at end of file
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 04/28] sstate: Handle manifest 'corruption' issue
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 02/28] glibc: Add 8GB VM usage cap for usermode test suite Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 03/28] cups: whitelist CVE-2021-25317 Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 05/28] ccache: add packageconfig docs option Richard Purdie
` (23 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
Under certain build patterns, warnings about missing manifests can appear. These
are real issues where the manifest was removed and shouldn't have been.
Martin Jansa was able to find a reproducer of:
MACHINE=qemux86 bitbake zlib-native
echo 'PR = "r1"' >> meta/recipes-core/zlib/zlib_1.2.11.bb
MACHINE=qemux86-64 bitbake zlib-native
MACHINE=qemux86 bitbake zlib-native
<the zlib-native manifest is now removed along with the sysroot-components contents>
The code maintains a per machine list of stamps but a per PACAGE_ARCH list of
stamp/manifest/workdir mappings. The latter is only appended to for speed with
the assumption that once stamps are gone, the code wouldn't trigger.
The code only ever appends to the mapping list (for speed/efficency under lock)
meaning that multiple entries can result where the stamp/workdir differs due to
version changes but the manifest remains the same.
By switching MACHINE part way through the build, the older stamp is referenced
and the manifest is incorrectly removed as it matches an now obsolete entry in
the mapping file.
There are two possible fixes, one is to rewrite the mapping file every time
which means adding regexs, iterating and generally complicating that code. The
second option is to only use the last mapping entry in the file for a given
manifest and ignore any earlier ones. This patch implments the latter.
Also drop the stale entries if we are rewriting it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/classes/sstate.bbclass | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/meta/classes/sstate.bbclass b/meta/classes/sstate.bbclass
index 8e8efd18d58..79588df2cdb 100644
--- a/meta/classes/sstate.bbclass
+++ b/meta/classes/sstate.bbclass
@@ -319,6 +319,8 @@ def sstate_install(ss, d):
if os.path.exists(i):
with open(i, "r") as f:
manifests = f.readlines()
+ # We append new entries, we don't remove older entries which may have the same
+ # manifest name but different versions from stamp/workdir. See below.
if filedata not in manifests:
with open(i, "a+") as f:
f.write(filedata)
@@ -1183,11 +1185,21 @@ python sstate_eventhandler_reachablestamps() {
i = d.expand("${SSTATE_MANIFESTS}/index-" + a)
if not os.path.exists(i):
continue
+ manseen = set()
+ ignore = []
with open(i, "r") as f:
lines = f.readlines()
- for l in lines:
+ for l in reversed(lines):
try:
(stamp, manifest, workdir) = l.split()
+ # The index may have multiple entries for the same manifest as the code above only appends
+ # new entries and there may be an entry with matching manifest but differing version in stamp/workdir.
+ # The last entry in the list is the valid one, any earlier entries with matching manifests
+ # should be ignored.
+ if manifest in manseen:
+ ignore.append(l)
+ continue
+ manseen.add(manifest)
if stamp not in stamps and stamp not in preservestamps and stamp in machineindex:
toremove.append(l)
if stamp not in seen:
@@ -1218,6 +1230,8 @@ python sstate_eventhandler_reachablestamps() {
with open(i, "w") as f:
for l in lines:
+ if l in ignore:
+ continue
f.write(l)
machineindex |= set(stamps)
with open(mi, "w") as f:
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 05/28] ccache: add packageconfig docs option
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (2 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 04/28] sstate: Handle manifest 'corruption' issue Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 06/28] libxml2: fix CVE-2021-3517 Richard Purdie
` (22 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Bastian Krause, Peter Kjellerstedt
From: Bastian Krause <bst@pengutronix.de>
Before, ccache's configure stage built HTML documentation and man pages
depending on if asciidoc is installed. This patch makes it configurable.
Pass the new cmake option ENABLE_DOCUMENTATION along and add the
asciidoc dependency if necessary.
This fixes an issue when ccache's configure stage found asciidoc/a2x on
the system outside of the sysroot (e.g. installed via 'apt install
asciidoc'). ccache would then decide to build docs and manual pages, but
would fail during compilation: the system's a2x could not find the
system's asciidoc because it did not reside in the set PATH.
By enabling/disabling docs/man page generation explicitly and adding
asciidoc to DEPENDS as necessary, this is no longer an issue.
[ This corresponds to commit b0aedd74 and parts of commit 1eedc5f8,
with the patch replaced by the upstream version. ]
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
...-build-of-documentation-optional-842.patch | 36 +++++++++++++++++++
meta/recipes-devtools/ccache/ccache_4.2.bb | 4 +++
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-devtools/ccache/ccache/0001-CMake-make-build-of-documentation-optional-842.patch
diff --git a/meta/recipes-devtools/ccache/ccache/0001-CMake-make-build-of-documentation-optional-842.patch b/meta/recipes-devtools/ccache/ccache/0001-CMake-make-build-of-documentation-optional-842.patch
new file mode 100644
index 00000000000..9f6bb1780ba
--- /dev/null
+++ b/meta/recipes-devtools/ccache/ccache/0001-CMake-make-build-of-documentation-optional-842.patch
@@ -0,0 +1,36 @@
+From 857d74f2c5fff79589e9b35cd405bf8ffffafb54 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 3 May 2021 18:44:53 +0200
+Subject: [PATCH] CMake: make build of documentation optional (#842)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So we don't need to support corner cases as for example one fixed in
+commit f6202db308e3 ("doc/MANUAL.adoc: Don't use non-ASCII quotes
+(#761)") when the documentation is actually not needed at all as ccache
+is used as a build tool only.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+Upstream-Status: Backport [b96ca763c453a602b5516b4b9ca5e2829528e318]
+Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
+---
+ CMakeLists.txt | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 40e21a57..151cc5f7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -131,7 +131,10 @@ target_link_libraries(ccache PRIVATE standard_settings standard_warnings ccache_
+ #
+ # Documentation
+ #
+-add_subdirectory(doc)
++option(ENABLE_DOCUMENTATION "Enable documentation" ON)
++if(ENABLE_DOCUMENTATION)
++ add_subdirectory(doc)
++endif()
+
+ #
+ # Installation
diff --git a/meta/recipes-devtools/ccache/ccache_4.2.bb b/meta/recipes-devtools/ccache/ccache_4.2.bb
index 9957bc7e651..b76bf043f01 100644
--- a/meta/recipes-devtools/ccache/ccache_4.2.bb
+++ b/meta/recipes-devtools/ccache/ccache_4.2.bb
@@ -12,10 +12,14 @@ LIC_FILES_CHKSUM = "file://LICENSE.adoc;md5=28afb89f649f309e7ac1aab554564637"
DEPENDS = "zstd"
SRC_URI = "https://github.com/ccache/ccache/releases/download/v${PV}/${BP}.tar.gz"
+SRC_URI += "file://0001-CMake-make-build-of-documentation-optional-842.patch"
+
SRC_URI[sha256sum] = "dbf139ff32031b54cb47f2d7983269f328df14b5a427882f89f7721e5c411b7e"
UPSTREAM_CHECK_URI = "https://github.com/ccache/ccache/releases/"
+PACKAGECONFIG[docs] = "-DENABLE_DOCUMENTATION=ON,-DENABLE_DOCUMENTATION=OFF,asciidoc"
+
inherit cmake
PATCHTOOL = "patch"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 06/28] libxml2: fix CVE-2021-3517
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (3 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 05/28] ccache: add packageconfig docs option Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 07/28] libxml2: fix CVE-2021-3516 Richard Purdie
` (21 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Tony Tascioglu
From: Tony Tascioglu <tony.tascioglu@windriver.com>
Fixes heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c
CVE: CVE-2021-3517
Upstream-status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2]
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../libxml/libxml2/CVE-2021-3517.patch | 54 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 +
2 files changed, 55 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2021-3517.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2021-3517.patch b/meta/recipes-core/libxml/libxml2/CVE-2021-3517.patch
new file mode 100644
index 00000000000..b6204f655a9
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2021-3517.patch
@@ -0,0 +1,54 @@
+From df3de1376585f7a273d70023f92a530395957324 Mon Sep 17 00:00:00 2001
+From: Joel Hockey <joel.hockey@gmail.com>
+Date: Sun, 16 Aug 2020 17:19:35 -0700
+Subject: [PATCH 1/3] Validate UTF8 in xmlEncodeEntities
+
+Code is currently assuming UTF-8 without validating. Truncated UTF-8
+input can cause out-of-bounds array access.
+
+Adds further checks to partial fix in 50f06b3e.
+
+Fixes #178
+
+CVE: CVE-2021-3517
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2]
+
+Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
+---
+ entities.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/entities.c b/entities.c
+index d575e9d1..7cdbc4de 100644
+--- a/entities.c
++++ b/entities.c
+@@ -666,11 +666,25 @@ xmlEncodeEntitiesInternal(xmlDocPtr doc, const xmlChar *input, int attr) {
+ } else {
+ /*
+ * We assume we have UTF-8 input.
++ * It must match either:
++ * 110xxxxx 10xxxxxx
++ * 1110xxxx 10xxxxxx 10xxxxxx
++ * 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
++ * That is:
++ * cur[0] is 11xxxxxx
++ * cur[1] is 10xxxxxx
++ * cur[2] is 10xxxxxx if cur[0] is 111xxxxx
++ * cur[3] is 10xxxxxx if cur[0] is 1111xxxx
++ * cur[0] is not 11111xxx
+ */
+ char buf[11], *ptr;
+ int val = 0, l = 1;
+
+- if (*cur < 0xC0) {
++ if (((cur[0] & 0xC0) != 0xC0) ||
++ ((cur[1] & 0xC0) != 0x80) ||
++ (((cur[0] & 0xE0) == 0xE0) && ((cur[2] & 0xC0) != 0x80)) ||
++ (((cur[0] & 0xF0) == 0xF0) && ((cur[3] & 0xC0) != 0x80)) ||
++ (((cur[0] & 0xF8) == 0xF8))) {
+ xmlEntitiesErr(XML_CHECK_NOT_UTF8,
+ "xmlEncodeEntities: input not UTF-8");
+ if (doc != NULL)
+--
+2.25.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index 07ae68610c8..ad612379b3f 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -24,6 +24,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
file://CVE-2019-20388.patch \
file://CVE-2020-24977.patch \
file://fix-python39.patch \
+ file://CVE-2021-3517.patch \
"
SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 07/28] libxml2: fix CVE-2021-3516
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (4 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 06/28] libxml2: fix CVE-2021-3517 Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 08/28] libxml2: fix CVE-2021-3537 Richard Purdie
` (20 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Tony Tascioglu
From: Tony Tascioglu <tony.tascioglu@windriver.com>
Fixes use-after-free in xmlEncodeEntitiesInternal() in entities.c
CVE: CVE-2021-3516
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539]
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../libxml/libxml2/CVE-2021-3516.patch | 36 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch b/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch
new file mode 100644
index 00000000000..287a171924d
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch
@@ -0,0 +1,36 @@
+From b76718876953e11bbd73dc6c9457323fd5aeda2e Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 21 Apr 2021 13:23:27 +0200
+Subject: [PATCH 2/3] Fix use-after-free with `xmllint --html --push`
+
+Call htmlCtxtUseOptions to make sure that names aren't stored in
+dictionaries.
+
+Note that this issue only affects xmllint using the HTML push parser.
+
+Fixes #230.
+
+CVE: CVE-2021-3516
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539]
+
+Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
+---
+ xmllint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xmllint.c b/xmllint.c
+index c0712674..ba66676b 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -2204,7 +2204,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
+ if (res > 0) {
+ ctxt = htmlCreatePushParserCtxt(NULL, NULL,
+ chars, res, filename, XML_CHAR_ENCODING_NONE);
+- xmlCtxtUseOptions(ctxt, options);
++ htmlCtxtUseOptions(ctxt, options);
+ while ((res = fread(chars, 1, pushsize, f)) > 0) {
+ htmlParseChunk(ctxt, chars, res, 0);
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index ad612379b3f..6f1229c2d08 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -25,6 +25,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
file://CVE-2020-24977.patch \
file://fix-python39.patch \
file://CVE-2021-3517.patch \
+ file://CVE-2021-3516.patch \
"
SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 08/28] libxml2: fix CVE-2021-3537
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (5 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 07/28] libxml2: fix CVE-2021-3516 Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 09/28] glibc: Document and whitelist CVE-2019-1010022-25 Richard Purdie
` (19 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Tony Tascioglu
From: Tony Tascioglu <tony.tascioglu@windriver.com>
Parsing specially crafted Mixed Content while parsing XML data may
lead to invalid data structure being created, as errors were not
propagated. This could lead to several NULL Pointer Dereference when
post-validating documents parsed in recovery mode.
CVE: CVE-2021-3537
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61]
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../libxml/libxml2/CVE-2021-3537.patch | 49 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2021-3537.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2021-3537.patch b/meta/recipes-core/libxml/libxml2/CVE-2021-3537.patch
new file mode 100644
index 00000000000..defbe7867b4
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2021-3537.patch
@@ -0,0 +1,49 @@
+From 5ae9c39401f679648301efa6d2d35e09cc376462 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 1 May 2021 16:53:33 +0200
+Subject: [PATCH 3/3] Propagate error in xmlParseElementChildrenContentDeclPriv
+
+Check return value of recursive calls to
+xmlParseElementChildrenContentDeclPriv and return immediately in case
+of errors. Otherwise, struct xmlElementContent could contain unexpected
+null pointers, leading to a null deref when post-validating documents
+which aren't well-formed and parsed in recovery mode.
+
+Fixes #243.
+
+CVE: CVE-2021-3537
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61]
+
+Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
+---
+ parser.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/parser.c b/parser.c
+index a34bb6cd..bbcff39f 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6195,6 +6195,8 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
+ SKIP_BLANKS;
+ cur = ret = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
+ depth + 1);
++ if (cur == NULL)
++ return(NULL);
+ SKIP_BLANKS;
+ GROW;
+ } else {
+@@ -6328,6 +6330,11 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
+ SKIP_BLANKS;
+ last = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
+ depth + 1);
++ if (last == NULL) {
++ if (ret != NULL)
++ xmlFreeDocElementContent(ctxt->myDoc, ret);
++ return(NULL);
++ }
+ SKIP_BLANKS;
+ } else {
+ elem = xmlParseName(ctxt);
+--
+2.25.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index 6f1229c2d08..b850164285a 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -26,6 +26,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
file://fix-python39.patch \
file://CVE-2021-3517.patch \
file://CVE-2021-3516.patch \
+ file://CVE-2021-3537.patch \
"
SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 09/28] glibc: Document and whitelist CVE-2019-1010022-25
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (6 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 08/28] libxml2: fix CVE-2021-3537 Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 10/28] libnotify: whitelist CVE-2013-7381 (specific to the NodeJS bindings) Richard Purdie
` (18 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
These CVEs are disputed by upstream and there is no plan to fix/address them. No
other distros are carrying patches for them. There is a patch for 1010025
however it isn't merged upstream and probably carries more risk of other bugs
than not having it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-core/glibc/glibc_2.33.bb | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/meta/recipes-core/glibc/glibc_2.33.bb b/meta/recipes-core/glibc/glibc_2.33.bb
index 5e0baa53e8d..75a1f36d6bf 100644
--- a/meta/recipes-core/glibc/glibc_2.33.bb
+++ b/meta/recipes-core/glibc/glibc_2.33.bb
@@ -3,6 +3,19 @@ require glibc-version.inc
CVE_CHECK_WHITELIST += "CVE-2020-10029"
+# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010022
+# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010023
+# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010024
+# Upstream glibc maintainers dispute there is any issue and have no plans to address it further.
+# "this is being treated as a non-security bug and no real threat."
+CVE_CHECK_WHITELIST += "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024"
+
+# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010025
+# Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow
+# easier access for another. "ASLR bypass itself is not a vulnerability."
+# Potential patch at https://sourceware.org/bugzilla/show_bug.cgi?id=22853
+CVE_CHECK_WHITELIST += "CVE-2019-1010025"
+
DEPENDS += "gperf-native bison-native make-native"
NATIVESDKFIXES ?= ""
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 10/28] libnotify: whitelist CVE-2013-7381 (specific to the NodeJS bindings)
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (7 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 09/28] glibc: Document and whitelist CVE-2019-1010022-25 Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 11/28] builder: whitelist CVE-2008-4178 (a different builder) Richard Purdie
` (17 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Ross Burton, Ross Burton
From: Ross Burton <ross@burtonini.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-gnome/libnotify/libnotify_0.7.9.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-gnome/libnotify/libnotify_0.7.9.bb b/meta/recipes-gnome/libnotify/libnotify_0.7.9.bb
index 1ff4b2e15fe..bbbd72193e2 100644
--- a/meta/recipes-gnome/libnotify/libnotify_0.7.9.bb
+++ b/meta/recipes-gnome/libnotify/libnotify_0.7.9.bb
@@ -30,3 +30,6 @@ PROVIDES += "libnotify3"
RPROVIDES_${PN} += "libnotify3"
RCONFLICTS_${PN} += "libnotify3"
RREPLACES_${PN} += "libnotify3"
+
+# -7381 is specific to the NodeJS bindings
+CVE_CHECK_WHITELIST += "CVE-2013-7381"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 11/28] builder: whitelist CVE-2008-4178 (a different builder)
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (8 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 10/28] libnotify: whitelist CVE-2013-7381 (specific to the NodeJS bindings) Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 12/28] qemu: Exclude CVE-2017-5957 from cve-check Richard Purdie
` (16 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Ross Burton, Ross Burton
From: Ross Burton <ross@burtonini.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-graphics/builder/builder_0.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-graphics/builder/builder_0.1.bb b/meta/recipes-graphics/builder/builder_0.1.bb
index 0a64c31ab3c..9d5cd8cde6c 100644
--- a/meta/recipes-graphics/builder/builder_0.1.bb
+++ b/meta/recipes-graphics/builder/builder_0.1.bb
@@ -29,3 +29,5 @@ do_install () {
chown builder.builder ${D}${sysconfdir}/mini_x/session.d/builder_session.sh
}
+# -4178 is an unrelated 'builder'
+CVE_CHECK_WHITELIST = "CVE-2008-4178"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 12/28] qemu: Exclude CVE-2017-5957 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (9 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 11/28] builder: whitelist CVE-2008-4178 (a different builder) Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 13/28] qemu: Exclude CVE-2007-0998 " Richard Purdie
` (15 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core; +Cc: Steve Sakoman
The CVE applies to virglrender before 0.6.0 which we don't have.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9b5355375d028577de0b98e05992de6a088cb972)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/qemu/qemu.inc | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 8b8cecd7a0a..e1c1bfdbfe5 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -65,6 +65,9 @@ SRC_URI[sha256sum] = "cb18d889b628fbe637672b0326789d9b0e3b8027e0445b936537c78549
SRC_URI_append_class-target = " file://cross.patch"
SRC_URI_append_class-nativesdk = " file://cross.patch"
+# Applies against virglrender < 0.6.0 and not qemu itself
+CVE_CHECK_WHITELIST += "CVE-2017-5957"
+
COMPATIBLE_HOST_mipsarchn32 = "null"
COMPATIBLE_HOST_mipsarchn64 = "null"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 13/28] qemu: Exclude CVE-2007-0998 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (10 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 12/28] qemu: Exclude CVE-2017-5957 from cve-check Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 14/28] qemu: Exclude CVE-2018-18438 " Richard Purdie
` (14 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
The CVE applies to the built-in VNC server but we don't enable this by default.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-devtools/qemu/qemu.inc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index e1c1bfdbfe5..c56f341a5e1 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -68,6 +68,10 @@ SRC_URI_append_class-nativesdk = " file://cross.patch"
# Applies against virglrender < 0.6.0 and not qemu itself
CVE_CHECK_WHITELIST += "CVE-2017-5957"
+# The VNC server can expose host files uder some circumstances. We don't
+# enable it by default.
+CVE_CHECK_WHITELIST += "CVE-2007-0998"
+
COMPATIBLE_HOST_mipsarchn32 = "null"
COMPATIBLE_HOST_mipsarchn64 = "null"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 14/28] qemu: Exclude CVE-2018-18438 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (11 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 13/28] qemu: Exclude CVE-2007-0998 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 15/28] jquery: Exclude CVE-2007-2379 " Richard Purdie
` (13 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
The issues were investigated and found not to be an issue therefore
exclude from checks.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-devtools/qemu/qemu.inc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index c56f341a5e1..fbda0c91741 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -72,6 +72,10 @@ CVE_CHECK_WHITELIST += "CVE-2017-5957"
# enable it by default.
CVE_CHECK_WHITELIST += "CVE-2007-0998"
+# 'The issues identified by this CVE were determined to not constitute a vulnerability.'
+# https://bugzilla.redhat.com/show_bug.cgi?id=1609015#c11
+CVE_CHECK_WHITELIST += "CVE-2018-18438"
+
COMPATIBLE_HOST_mipsarchn32 = "null"
COMPATIBLE_HOST_mipsarchn64 = "null"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 15/28] jquery: Exclude CVE-2007-2379 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (12 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 14/28] qemu: Exclude CVE-2018-18438 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 16/28] logrotate: Exclude CVE-2011-1548,1549,1550 " Richard Purdie
` (12 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
The CVE is non-specific and depends on the users of jquery, doesn't
make sense to have this flagged against jquery as there is nothing we can
do about it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-devtools/jquery/jquery_3.6.0.bb | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/meta/recipes-devtools/jquery/jquery_3.6.0.bb b/meta/recipes-devtools/jquery/jquery_3.6.0.bb
index 65905966c1c..03792730fd2 100644
--- a/meta/recipes-devtools/jquery/jquery_3.6.0.bb
+++ b/meta/recipes-devtools/jquery/jquery_3.6.0.bb
@@ -19,6 +19,11 @@ SRC_URI[map.sha256sum] = "399548fb0e7b146c12f5ba18099a47d594a970fee96212eee0ab48
UPSTREAM_CHECK_REGEX = "jquery-(?P<pver>\d+(\.\d+)+)\.js"
+# https://github.com/jquery/jquery/issues/3927
+# There are ways jquery can expose security issues but any issues are in the apps exposing them
+# and there is little we can directly do
+CVE_CHECK_WHITELIST += "CVE-2007-2379"
+
inherit allarch
do_install() {
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 16/28] logrotate: Exclude CVE-2011-1548,1549,1550 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (13 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 15/28] jquery: Exclude CVE-2007-2379 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 17/28] openssh: Exclude CVE-2007-2768 " Richard Purdie
` (11 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
These CVEs apply to the way logrotate was installed on Gentoo, Debian
and SUSE, exclude from cve-check as they don't apply to OE.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-extended/logrotate/logrotate_3.18.0.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-extended/logrotate/logrotate_3.18.0.bb b/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
index 55684ac9fbc..c2115e7142d 100644
--- a/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
+++ b/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
@@ -21,6 +21,9 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.xz
SRC_URI[sha256sum] = "841f81bf09d0014e4a2e11af166bb33fcd8429cc0c2d4a7d3d9ceb3858cfccc5"
+# These CVEs are debian, gentoo or SUSE specific on the way logrotate was installed/used
+CVE_CHECK_WHITELIST += "CVE-2011-1548 CVE-2011-1549 CVE-2011-1550"
+
PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'acl selinux', d)}"
PACKAGECONFIG[acl] = ",,acl"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 17/28] openssh: Exclude CVE-2007-2768 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (14 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 16/28] logrotate: Exclude CVE-2011-1548,1549,1550 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 18/28] openssh: Exclude CVE-2008-3844 " Richard Purdie
` (10 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
We don't build/use the OPIE PAM module, exclude the CVE from this recipe.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-connectivity/openssh/openssh_8.5p1.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-connectivity/openssh/openssh_8.5p1.bb b/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
index 6a49cf71ccf..41ac303d38d 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
@@ -27,6 +27,9 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
"
SRC_URI[sha256sum] = "f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25"
+# This CVE is specific to OpenSSH with the pam opie which we don't build/use here
+CVE_CHECK_WHITELIST += "CVE-2007-2768"
+
# This CVE is specific to OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7
# and when running in a Kerberos environment. As such it is not relevant to OpenEmbedded
CVE_CHECK_WHITELIST += "CVE-2014-9278"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 18/28] openssh: Exclude CVE-2008-3844 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (15 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 17/28] openssh: Exclude CVE-2007-2768 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 19/28] unzip: Exclude CVE-2008-0888 " Richard Purdie
` (9 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
CVE only applies to some distributed RHEL binaries so irrelavent to us.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-connectivity/openssh/openssh_8.5p1.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-connectivity/openssh/openssh_8.5p1.bb b/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
index 41ac303d38d..c6de5198849 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.5p1.bb
@@ -34,6 +34,9 @@ CVE_CHECK_WHITELIST += "CVE-2007-2768"
# and when running in a Kerberos environment. As such it is not relevant to OpenEmbedded
CVE_CHECK_WHITELIST += "CVE-2014-9278"
+# CVE only applies to some distributed RHEL binaries
+CVE_CHECK_WHITELIST += "CVE-2008-3844"
+
PAM_SRC_URI = "file://sshd"
inherit manpages useradd update-rc.d update-alternatives systemd
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 19/28] unzip: Exclude CVE-2008-0888 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (16 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 18/28] openssh: Exclude CVE-2008-3844 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 20/28] cpio: Exclude CVE-2010-4226 " Richard Purdie
` (8 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
The patch mentioned as the fix for the CVE is applied to the 6.0 source
code. Zip versioning makes CPE entry changes hard.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-extended/unzip/unzip_6.0.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-extended/unzip/unzip_6.0.bb b/meta/recipes-extended/unzip/unzip_6.0.bb
index 0c56a39d921..af5530ab386 100644
--- a/meta/recipes-extended/unzip/unzip_6.0.bb
+++ b/meta/recipes-extended/unzip/unzip_6.0.bb
@@ -32,6 +32,9 @@ UPSTREAM_VERSION_UNKNOWN = "1"
SRC_URI[md5sum] = "62b490407489521db863b523a7f86375"
SRC_URI[sha256sum] = "036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37"
+# Patch from https://bugzilla.redhat.com/attachment.cgi?id=293893&action=diff applied to 6.0 source
+CVE_CHECK_WHITELIST += "CVE-2008-0888"
+
# exclude version 5.5.2 which triggers a false positive
UPSTREAM_CHECK_REGEX = "unzip(?P<pver>(?!552).+)\.tgz"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 20/28] cpio: Exclude CVE-2010-4226 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (17 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 19/28] unzip: Exclude CVE-2008-0888 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 21/28] ghostscript: Exclude CVE-2013-6629 " Richard Purdie
` (7 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
Issue applies to use of cpio in SUSE/OBS, doesn't apply to us.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-extended/cpio/cpio_2.13.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-extended/cpio/cpio_2.13.bb b/meta/recipes-extended/cpio/cpio_2.13.bb
index 94d86100c74..f4df826ed9c 100644
--- a/meta/recipes-extended/cpio/cpio_2.13.bb
+++ b/meta/recipes-extended/cpio/cpio_2.13.bb
@@ -16,6 +16,9 @@ SRC_URI[sha256sum] = "e87470d9c984317f658567c03bfefb6b0c829ff17dbf6b0de48d71a4c8
inherit autotools gettext texinfo
+# Issue applies to use of cpio in SUSE/OBS, doesn't apply to us
+CVE_CHECK_WHITELIST += "CVE-2010-4226"
+
EXTRA_OECONF += "DEFAULT_RMT_DIR=${sbindir}"
do_install () {
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 21/28] ghostscript: Exclude CVE-2013-6629 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (18 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 20/28] cpio: Exclude CVE-2010-4226 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 22/28] bluez: Exclude CVE-2020-12352 CVE-2020-24490 " Richard Purdie
` (6 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
The CVE is in the jpeg sources included with ghostscript. We use our own
external jpeg library so this doesn't affect us.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-extended/ghostscript/ghostscript_9.53.3.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.53.3.bb b/meta/recipes-extended/ghostscript/ghostscript_9.53.3.bb
index cbf60c8c855..35826c25498 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.53.3.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.53.3.bb
@@ -19,6 +19,10 @@ DEPENDS_class-native = "libpng-native"
UPSTREAM_CHECK_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases"
UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.tar"
+# As of ghostscript 9.54.0 the jpeg issue in the CVE is present in the gs jpeg sources
+# however we use an external jpeg which doesn't have the issue.
+CVE_CHECK_WHITELIST += "CVE-2013-6629"
+
def gs_verdir(v):
return "".join(v.split("."))
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 22/28] bluez: Exclude CVE-2020-12352 CVE-2020-24490 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (19 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 21/28] ghostscript: Exclude CVE-2013-6629 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 23/28] tiff: Exclude CVE-2015-7313 " Richard Purdie
` (5 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
These CVEs are fixed with kernel changes and don't affect the bluez recipe.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-connectivity/bluez5/bluez5_5.56.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.56.bb b/meta/recipes-connectivity/bluez5/bluez5_5.56.bb
index 676cb2dbb2a..ae0f72b678a 100644
--- a/meta/recipes-connectivity/bluez5/bluez5_5.56.bb
+++ b/meta/recipes-connectivity/bluez5/bluez5_5.56.bb
@@ -3,6 +3,9 @@ require bluez5.inc
SRC_URI[md5sum] = "e6c51b2aefa7c56ff072819a78611fa5"
SRC_URI[sha256sum] = "59c4dba9fc8aae2a6a5f8f12f19bc1b0c2dc27355c7ca3123eed3fe6bd7d0b9d"
+# These issues have kernel fixes rather than bluez fixes so exclude here
+CVE_CHECK_WHITELIST += "CVE-2020-12352 CVE-2020-24490"
+
# noinst programs in Makefile.tools that are conditional on READLINE
# support
NOINST_TOOLS_READLINE ?= " \
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 23/28] tiff: Exclude CVE-2015-7313 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (20 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 22/28] bluez: Exclude CVE-2020-12352 CVE-2020-24490 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 24/28] coreutils: Exclude CVE-2016-2781 " Richard Purdie
` (4 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
Some fix upstream addresses the issue, it isn't clear which change this was. Our
current version doesn't have issues with the test image though so we can exclude.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-multimedia/libtiff/tiff_4.2.0.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.2.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.2.0.bb
index ea8580a25e4..6ca01af2fa9 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.2.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.2.0.bb
@@ -15,6 +15,10 @@ SRC_URI[sha256sum] = "eb0484e568ead8fa23b513e9b0041df7e327f4ee2d22db5a533929dfc1
# exclude betas
UPSTREAM_CHECK_REGEX = "tiff-(?P<pver>\d+(\.\d+)+).tar"
+# Tested with check from https://security-tracker.debian.org/tracker/CVE-2015-7313
+# and 4.3.0 doesn't have the issue
+CVE_CHECK_WHITELIST += "CVE-2015-7313"
+
inherit autotools multilib_header
CACHED_CONFIGUREVARS = "ax_cv_check_gl_libgl=no"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 24/28] coreutils: Exclude CVE-2016-2781 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (21 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 23/28] tiff: Exclude CVE-2015-7313 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:48 ` [hardknott] [PATCH 25/28] librsvg: Exclude CVE-2018-1000041 " Richard Purdie
` (3 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=v8.27-101-gf5d7c0842
"Given runcon is not really a sandbox command, the advice is to use
`runcon ... setsid ...` to avoid this particular issue.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-core/coreutils/coreutils_8.32.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-core/coreutils/coreutils_8.32.bb b/meta/recipes-core/coreutils/coreutils_8.32.bb
index c1962ccb909..f3fe31fd3bd 100644
--- a/meta/recipes-core/coreutils/coreutils_8.32.bb
+++ b/meta/recipes-core/coreutils/coreutils_8.32.bb
@@ -26,6 +26,10 @@ SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
SRC_URI[md5sum] = "022042695b7d5bcf1a93559a9735e668"
SRC_URI[sha256sum] = "4458d8de7849df44ccab15e16b1548b285224dbba5f08fac070c1c0e0bcc4cfa"
+# http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=v8.27-101-gf5d7c0842
+# runcon is not really a sandbox command, use `runcon ... setsid ...` to avoid this particular issue.
+CVE_CHECK_WHITELIST += "CVE-2016-2781"
+
EXTRA_OECONF_class-native = "--without-gmp"
EXTRA_OECONF_class-target = "--enable-install-program=arch,hostname --libexecdir=${libdir}"
EXTRA_OECONF_class-nativesdk = "--enable-install-program=arch,hostname"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 25/28] librsvg: Exclude CVE-2018-1000041 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (22 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 24/28] coreutils: Exclude CVE-2016-2781 " Richard Purdie
@ 2021-05-20 20:48 ` Richard Purdie
2021-05-20 20:49 ` [hardknott] [PATCH 26/28] avahi: Exclude CVE-2021-26720 " Richard Purdie
` (2 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:48 UTC (permalink / raw)
To: openembedded-core
Issue only affects windows.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-gnome/librsvg/librsvg_2.40.21.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-gnome/librsvg/librsvg_2.40.21.bb b/meta/recipes-gnome/librsvg/librsvg_2.40.21.bb
index acdbc1f1b3d..59de80a691d 100644
--- a/meta/recipes-gnome/librsvg/librsvg_2.40.21.bb
+++ b/meta/recipes-gnome/librsvg/librsvg_2.40.21.bb
@@ -25,6 +25,9 @@ SRC_URI += "file://gtk-option.patch \
SRC_URI[archive.sha256sum] = "f7628905f1cada84e87e2b14883ed57d8094dca3281d5bcb24ece4279e9a92ba"
+# Issue only on windows
+CVE_CHECK_WHITELIST += "CVE-2018-1000041"
+
CACHED_CONFIGUREVARS = "ac_cv_path_GDK_PIXBUF_QUERYLOADERS=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
PACKAGECONFIG ??= "gdkpixbuf"
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 26/28] avahi: Exclude CVE-2021-26720 from cve-check
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (23 preceding siblings ...)
2021-05-20 20:48 ` [hardknott] [PATCH 25/28] librsvg: Exclude CVE-2018-1000041 " Richard Purdie
@ 2021-05-20 20:49 ` Richard Purdie
2021-05-20 20:49 ` [hardknott] [PATCH 27/28] image.bbclass: fix comment "pacackages" -> "packages" Richard Purdie
2021-05-20 20:49 ` [hardknott] [PATCH 28/28] meta/lib/oe/rootfs.py: Fix typo "Restoreing" -> "Restoring" Richard Purdie
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:49 UTC (permalink / raw)
To: openembedded-core
Issue only affects Debian and SUSE.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-connectivity/avahi/avahi_0.8.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb
index c8a3f876aa9..23c0e8d8239 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -30,6 +30,9 @@ UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/"
SRC_URI[md5sum] = "229c6aa30674fc43c202b22c5f8c2be7"
SRC_URI[sha256sum] = "060309d7a333d38d951bc27598c677af1796934dbd98e1024e7ad8de798fedda"
+# Issue only affects Debian/SUSE, not us
+CVE_CHECK_WHITELIST += "CVE-2021-26720"
+
DEPENDS = "expat libcap libdaemon glib-2.0 intltool-native"
# For gtk related PACKAGECONFIGs: gtk, gtk3
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 27/28] image.bbclass: fix comment "pacackages" -> "packages"
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (24 preceding siblings ...)
2021-05-20 20:49 ` [hardknott] [PATCH 26/28] avahi: Exclude CVE-2021-26720 " Richard Purdie
@ 2021-05-20 20:49 ` Richard Purdie
2021-05-20 20:49 ` [hardknott] [PATCH 28/28] meta/lib/oe/rootfs.py: Fix typo "Restoreing" -> "Restoring" Richard Purdie
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:49 UTC (permalink / raw)
To: openembedded-core; +Cc: Robert P. J. Day
From: "Robert P. J. Day" <rpjday@crashcourse.ca>
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/classes/image.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
index 353cc671759..67603d958d5 100644
--- a/meta/classes/image.bbclass
+++ b/meta/classes/image.bbclass
@@ -38,7 +38,7 @@ IMAGE_FEATURES[validitems] += "debug-tweaks read-only-rootfs read-only-rootfs-de
# Generate companion debugfs?
IMAGE_GEN_DEBUGFS ?= "0"
-# These pacackages will be installed as additional into debug rootfs
+# These packages will be installed as additional into debug rootfs
IMAGE_INSTALL_DEBUGFS ?= ""
# These packages will be removed from a read-only rootfs after all other
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread* [hardknott] [PATCH 28/28] meta/lib/oe/rootfs.py: Fix typo "Restoreing" -> "Restoring"
2021-05-20 20:48 [hardknott] [PATCH 01/28] uninative: Upgrade to 3.2 (gcc11 support) Richard Purdie
` (25 preceding siblings ...)
2021-05-20 20:49 ` [hardknott] [PATCH 27/28] image.bbclass: fix comment "pacackages" -> "packages" Richard Purdie
@ 2021-05-20 20:49 ` Richard Purdie
26 siblings, 0 replies; 28+ messages in thread
From: Richard Purdie @ 2021-05-20 20:49 UTC (permalink / raw)
To: openembedded-core; +Cc: Robert P. J. Day
From: "Robert P. J. Day" <rpjday@crashcourse.ca>
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/lib/oe/rootfs.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oe/rootfs.py b/meta/lib/oe/rootfs.py
index d634adda4e9..16493577e3b 100644
--- a/meta/lib/oe/rootfs.py
+++ b/meta/lib/oe/rootfs.py
@@ -167,7 +167,7 @@ class Rootfs(object, metaclass=ABCMeta):
pass
os.rename(self.image_rootfs, self.image_rootfs + '-dbg')
- bb.note(" Restoreing original rootfs...")
+ bb.note(" Restoring original rootfs...")
os.rename(self.image_rootfs + '-orig', self.image_rootfs)
def _exec_shell_cmd(self, cmd):
--
2.30.2
^ permalink raw reply related [flat|nested] 28+ messages in thread