[Buildroot] [PATCH-2019.02] package/glibc: bump version for additional post-2.28 security fixes

[Buildroot] [PATCH-2019.02] package/glibc: bump version for additional post-2.28 security fixes

[Peter Korsgaard]

Fixes the following security vulnerabilities:

  CVE-2019-6488: On x32, the size_t parameter may be passed in the lower
  32 bits of a 64-bit register with with non-zero upper 32 bit.  When it
  happened, accessing the 32-bit size_t value as the full 64-bit register
  in the assembly string/memory functions would cause a buffer overflow.
  Reported by H.J. Lu.

  CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check
  size.  For x86-64, memcmp on an object size larger than SSIZE_MAX
  has undefined behavior.  On x32, the size_t argument may be passed
  in the lower 32 bits of the 64-bit RDX register with non-zero upper
  32 bits.  When it happened with the sign bit of RDX register set,
  memcmp gave the wrong result since it treated the size argument as
  zero.  Reported by H.J. Lu.

  CVE-2016-10739: The getaddrinfo function could successfully parse IPv4
  addresses with arbitrary trailing characters, potentially leading to data
  or command injection issues in applications.

  CVE-2019-9169: Attempted case-insensitive regular-expression match
  via proceed_next_node in posix/regexec.c leads to heap-based buffer
  over-read.  Reported by Hongxu Chen.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 .../glibc.hash                                                          | 2 +-
 package/glibc/glibc.mk                                                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename package/glibc/{glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1 => glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a}/glibc.hash (69%)

diff --git a/package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash b/package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
similarity index 69%
rename from package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash
rename to package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
index e83b1caf4c..442ef0d7aa 100644
--- a/package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash
+++ b/package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
@@ -1,5 +1,5 @@
 # Locally calculated (fetched from Github)
-sha256  ebf04c7b00153d6df8beceec0666d4b13e1ac613b40d5774d1b8c6f61c1686e6  glibc-glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1.tar.gz
+sha256  295d436aac4dc45afc3b440f85fc4556c03b1140ca0f625ee015c8156d2f52ae  glibc-glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a.tar.gz
 
 # Hashes for license files
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index ec5b3cedc9..cb6f8097dc 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -13,7 +13,7 @@ GLIBC_SITE = $(call github,riscv,riscv-glibc,$(GLIBC_VERSION))
 else
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master
-GLIBC_VERSION = glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1
+GLIBC_VERSION = glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a
 # Upstream doesn't officially provide an https download link.
 # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
 # sometimes the connection times out. So use an unofficial github mirror.
-- 
2.11.0

[Buildroot] [PATCH-2019.02] package/glibc: bump version for additional post-2.28 security fixes

[yann.morin at orange.com]

Peter, All,

On 2019-03-29 10:47 +0100, Peter Korsgaard spake thusly:
[--SNIP--]
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
>  .../glibc.hash                                                          | 2 +-
>  package/glibc/glibc.mk                                                  | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>  rename package/glibc/{glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1 => glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a}/glibc.hash (69%)
> 
> diff --git a/package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash b/package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
> similarity index 69%
> rename from package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash
> rename to package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
> index e83b1caf4c..442ef0d7aa 100644
> --- a/package/glibc/glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1/glibc.hash
> +++ b/package/glibc/glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a/glibc.hash
> @@ -1,5 +1,5 @@
>  # Locally calculated (fetched from Github)
> -sha256  ebf04c7b00153d6df8beceec0666d4b13e1ac613b40d5774d1b8c6f61c1686e6  glibc-glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1.tar.gz
> +sha256  295d436aac4dc45afc3b440f85fc4556c03b1140ca0f625ee015c8156d2f52ae  glibc-glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a.tar.gz
>  
>  # Hashes for license files
>  sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
> diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
> index ec5b3cedc9..cb6f8097dc 100644
> --- a/package/glibc/glibc.mk
> +++ b/package/glibc/glibc.mk
> @@ -13,7 +13,7 @@ GLIBC_SITE = $(call github,riscv,riscv-glibc,$(GLIBC_VERSION))
>  else
>  # Generate version string using:
>  #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master
> -GLIBC_VERSION = glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1
> +GLIBC_VERSION = glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a

If you drop the leading 'glibc-' from the version string, it still
works, and makes for nicer filenames, as we have in master now for
glibc-2.29.

Note that, for 2019.02 that is an LTS, we may want to keep the ugly
filenames, though, for stability for those that have "instrumentation
scripts" above buildroot.

Regards,
Yann E. MORIN.

>  # Upstream doesn't officially provide an https download link.
>  # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
>  # sometimes the connection times out. So use an unofficial github mirror.
> -- 
> 2.11.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
                                        ____________
.-----------------.--------------------:       _    :------------------.
|  Yann E. MORIN  | Real-Time Embedded |    __/ )   | /"\ ASCII RIBBON |
| +33 534.541.179 | Software  Designer |  _/ - /'   | \ / CAMPAIGN     |
| +33 638.411.245 '--------------------: (_    `--, |  X  AGAINST      |
|      yann.morin (at) orange.com      |_="    ,--' | / \ HTML MAIL    |
'--------------------------------------:______/_____:------------------'


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

[Buildroot] [PATCH-2019.02] package/glibc: bump version for additional post-2.28 security fixes

[Peter Korsgaard]

>>>>>   <yann.morin@orange.com> writes:

Hi,

 >> # Generate version string using:
 >> #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master
 >> -GLIBC_VERSION = glibc-2.28-69-g1e5c5303a522764d7e9d2302a60e4a32cdb902f1
 >> +GLIBC_VERSION = glibc-2.28-94-g4aeff335ca19286ee2382d8eba794ae5fd49281a

 > If you drop the leading 'glibc-' from the version string, it still
 > works, and makes for nicer filenames, as we have in master now for
 > glibc-2.29.

Yes, I considered to do that..

 > Note that, for 2019.02 that is an LTS, we may want to keep the ugly
 > filenames, though, for stability for those that have "instrumentation
 > scripts" above buildroot.

.. and decided I wanted to keep things like they are for 2019.02.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH-2019.02] package/glibc: bump version for additional post-2.28 security fixes

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security vulnerabilities:
 >   CVE-2019-6488: On x32, the size_t parameter may be passed in the lower
 >   32 bits of a 64-bit register with with non-zero upper 32 bit.  When it
 >   happened, accessing the 32-bit size_t value as the full 64-bit register
 >   in the assembly string/memory functions would cause a buffer overflow.
 >   Reported by H.J. Lu.

 >   CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check
 >   size.  For x86-64, memcmp on an object size larger than SSIZE_MAX
 >   has undefined behavior.  On x32, the size_t argument may be passed
 >   in the lower 32 bits of the 64-bit RDX register with non-zero upper
 >   32 bits.  When it happened with the sign bit of RDX register set,
 >   memcmp gave the wrong result since it treated the size argument as
 >   zero.  Reported by H.J. Lu.

 >   CVE-2016-10739: The getaddrinfo function could successfully parse IPv4
 >   addresses with arbitrary trailing characters, potentially leading to data
 >   or command injection issues in applications.

 >   CVE-2019-9169: Attempted case-insensitive regular-expression match
 >   via proceed_next_node in posix/regexec.c leads to heap-based buffer
 >   over-read.  Reported by Hongxu Chen.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2019.02.x, thanks.

-- 
Bye, Peter Korsgaard