* [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937
@ 2021-02-26 23:22 Peter Korsgaard
2021-02-27 8:20 ` Yann E. MORIN
2021-03-09 22:59 ` Peter Korsgaard
0 siblings, 2 replies; 3+ messages in thread
From: Peter Korsgaard @ 2021-02-26 23:22 UTC (permalink / raw)
To: buildroot
encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a
denial of service (invalid write access and application crash) or possibly
have unspecified other impact via a crafted UTF-8 character sequence.
For more details, see the oss-security discussion:
https://www.openwall.com/lists/oss-security/2021/02/09/3
So far no fix has been added to upstream git, and a number of early proposed
fixes caused regressions, so pull the security fix from the screen 4.8.0-5
Debian package.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/screen/0008_CVE-2021-26937.patch | 68 ++++++++++++++++++++++++
package/screen/screen.mk | 3 ++
2 files changed, 71 insertions(+)
create mode 100644 package/screen/0008_CVE-2021-26937.patch
diff --git a/package/screen/0008_CVE-2021-26937.patch b/package/screen/0008_CVE-2021-26937.patch
new file mode 100644
index 0000000000..df7efa0294
--- /dev/null
+++ b/package/screen/0008_CVE-2021-26937.patch
@@ -0,0 +1,68 @@
+Description: [CVE-2021-26937] Fix out of bounds array access
+Author: Michael Schr?der <mls@suse.de>
+Bug-Debian: https://bugs.debian.org/982435
+Bug: https://savannah.gnu.org/bugs/?60030
+Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
+Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3
+Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html
+
+Downloaded from Debian:
+https://sources.debian.org/data/main/s/screen/4.8.0-5/debian/patches/99_CVE-2021-26937.patch
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+--- a/encoding.c
++++ b/encoding.c
+@@ -43,7 +43,7 @@
+ # ifdef UTF8
+ static int recode_char __P((int, int, int));
+ static int recode_char_to_encoding __P((int, int));
+-static void comb_tofront __P((int, int));
++static void comb_tofront __P((int));
+ # ifdef DW_CHARS
+ static int recode_char_dw __P((int, int *, int, int));
+ static int recode_char_dw_to_encoding __P((int, int *, int));
+@@ -1263,6 +1263,8 @@
+ {0x30000, 0x3FFFD},
+ };
+
++ if (c >= 0xdf00 && c <= 0xdfff)
++ return 1; /* dw combining sequence */
+ return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) ||
+ (cjkwidth &&
+ bisearch(c, ambiguous,
+@@ -1330,11 +1332,12 @@
+ }
+
+ static void
+-comb_tofront(root, i)
+-int root, i;
++comb_tofront(i)
++int i;
+ {
+ for (;;)
+ {
++ int root = i >= 0x700 ? 0x801 : 0x800;
+ debug1("bring to front: %x\n", i);
+ combchars[combchars[i]->prev]->next = combchars[i]->next;
+ combchars[combchars[i]->next]->prev = combchars[i]->prev;
+@@ -1396,9 +1399,9 @@
+ {
+ /* full, recycle old entry */
+ if (c1 >= 0xd800 && c1 < 0xe000)
+- comb_tofront(root, c1 - 0xd800);
++ comb_tofront(c1 - 0xd800);
+ i = combchars[root]->prev;
+- if (c1 == i + 0xd800)
++ if (i == 0x800 || i == 0x801 || c1 == i + 0xd800)
+ {
+ /* completely full, can't recycle */
+ debug("utf8_handle_comp: completely full!\n");
+@@ -1422,7 +1425,7 @@
+ mc->font = (i >> 8) + 0xd8;
+ mc->fontx = 0;
+ debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800);
+- comb_tofront(root, i);
++ comb_tofront(i);
+ }
+
+ #else /* !UTF8 */
diff --git a/package/screen/screen.mk b/package/screen/screen.mk
index c24067440e..f75f92cb47 100644
--- a/package/screen/screen.mk
+++ b/package/screen/screen.mk
@@ -15,6 +15,9 @@ SCREEN_CONF_ENV = CFLAGS="$(TARGET_CFLAGS)"
SCREEN_CONF_OPTS = --enable-colors256
SCREEN_INSTALL_TARGET_OPTS = DESTDIR=$(TARGET_DIR) SCREEN=screen install_bin
+# 0008_CVE-2021-26937.patch
+SCREEN_IGNORE_CVES += CVE-2021-26937
+
ifeq ($(BR2_PACKAGE_LINUX_PAM),y)
SCREEN_DEPENDENCIES += linux-pam
SCREEN_CONF_OPTS += --enable-pam
--
2.20.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937
2021-02-26 23:22 [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937 Peter Korsgaard
@ 2021-02-27 8:20 ` Yann E. MORIN
2021-03-09 22:59 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Yann E. MORIN @ 2021-02-27 8:20 UTC (permalink / raw)
To: buildroot
Peter, All,
On 2021-02-27 00:22 +0100, Peter Korsgaard spake thusly:
> encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a
> denial of service (invalid write access and application crash) or possibly
> have unspecified other impact via a crafted UTF-8 character sequence.
>
> For more details, see the oss-security discussion:
> https://www.openwall.com/lists/oss-security/2021/02/09/3
>
> So far no fix has been added to upstream git, and a number of early proposed
> fixes caused regressions, so pull the security fix from the screen 4.8.0-5
> Debian package.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Applied to master, thanks.
Regards,
Yann E. MORIN.
> ---
> package/screen/0008_CVE-2021-26937.patch | 68 ++++++++++++++++++++++++
> package/screen/screen.mk | 3 ++
> 2 files changed, 71 insertions(+)
> create mode 100644 package/screen/0008_CVE-2021-26937.patch
>
> diff --git a/package/screen/0008_CVE-2021-26937.patch b/package/screen/0008_CVE-2021-26937.patch
> new file mode 100644
> index 0000000000..df7efa0294
> --- /dev/null
> +++ b/package/screen/0008_CVE-2021-26937.patch
> @@ -0,0 +1,68 @@
> +Description: [CVE-2021-26937] Fix out of bounds array access
> +Author: Michael Schr?der <mls@suse.de>
> +Bug-Debian: https://bugs.debian.org/982435
> +Bug: https://savannah.gnu.org/bugs/?60030
> +Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
> +Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3
> +Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html
> +
> +Downloaded from Debian:
> +https://sources.debian.org/data/main/s/screen/4.8.0-5/debian/patches/99_CVE-2021-26937.patch
> +
> +Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> +--- a/encoding.c
> ++++ b/encoding.c
> +@@ -43,7 +43,7 @@
> + # ifdef UTF8
> + static int recode_char __P((int, int, int));
> + static int recode_char_to_encoding __P((int, int));
> +-static void comb_tofront __P((int, int));
> ++static void comb_tofront __P((int));
> + # ifdef DW_CHARS
> + static int recode_char_dw __P((int, int *, int, int));
> + static int recode_char_dw_to_encoding __P((int, int *, int));
> +@@ -1263,6 +1263,8 @@
> + {0x30000, 0x3FFFD},
> + };
> +
> ++ if (c >= 0xdf00 && c <= 0xdfff)
> ++ return 1; /* dw combining sequence */
> + return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) ||
> + (cjkwidth &&
> + bisearch(c, ambiguous,
> +@@ -1330,11 +1332,12 @@
> + }
> +
> + static void
> +-comb_tofront(root, i)
> +-int root, i;
> ++comb_tofront(i)
> ++int i;
> + {
> + for (;;)
> + {
> ++ int root = i >= 0x700 ? 0x801 : 0x800;
> + debug1("bring to front: %x\n", i);
> + combchars[combchars[i]->prev]->next = combchars[i]->next;
> + combchars[combchars[i]->next]->prev = combchars[i]->prev;
> +@@ -1396,9 +1399,9 @@
> + {
> + /* full, recycle old entry */
> + if (c1 >= 0xd800 && c1 < 0xe000)
> +- comb_tofront(root, c1 - 0xd800);
> ++ comb_tofront(c1 - 0xd800);
> + i = combchars[root]->prev;
> +- if (c1 == i + 0xd800)
> ++ if (i == 0x800 || i == 0x801 || c1 == i + 0xd800)
> + {
> + /* completely full, can't recycle */
> + debug("utf8_handle_comp: completely full!\n");
> +@@ -1422,7 +1425,7 @@
> + mc->font = (i >> 8) + 0xd8;
> + mc->fontx = 0;
> + debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800);
> +- comb_tofront(root, i);
> ++ comb_tofront(i);
> + }
> +
> + #else /* !UTF8 */
> diff --git a/package/screen/screen.mk b/package/screen/screen.mk
> index c24067440e..f75f92cb47 100644
> --- a/package/screen/screen.mk
> +++ b/package/screen/screen.mk
> @@ -15,6 +15,9 @@ SCREEN_CONF_ENV = CFLAGS="$(TARGET_CFLAGS)"
> SCREEN_CONF_OPTS = --enable-colors256
> SCREEN_INSTALL_TARGET_OPTS = DESTDIR=$(TARGET_DIR) SCREEN=screen install_bin
>
> +# 0008_CVE-2021-26937.patch
> +SCREEN_IGNORE_CVES += CVE-2021-26937
> +
> ifeq ($(BR2_PACKAGE_LINUX_PAM),y)
> SCREEN_DEPENDENCIES += linux-pam
> SCREEN_CONF_OPTS += --enable-pam
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937
2021-02-26 23:22 [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937 Peter Korsgaard
2021-02-27 8:20 ` Yann E. MORIN
@ 2021-03-09 22:59 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2021-03-09 22:59 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a
> denial of service (invalid write access and application crash) or possibly
> have unspecified other impact via a crafted UTF-8 character sequence.
> For more details, see the oss-security discussion:
> https://www.openwall.com/lists/oss-security/2021/02/09/3
> So far no fix has been added to upstream git, and a number of early proposed
> fixes caused regressions, so pull the security fix from the screen 4.8.0-5
> Debian package.
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed to 2020.02.x and 2020.11.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-09 22:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-26 23:22 [Buildroot] [PATCH] package/screen: add security fix for CVE-2021-26937 Peter Korsgaard
2021-02-27 8:20 ` Yann E. MORIN
2021-03-09 22:59 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.