* [OE-core][dunfell 00/16] Patch review
@ 2023-01-25 14:41 Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 01/16] cve-update-db-native: Allow to overrule the URL in a bbappend Steve Sakoman
` (15 more replies)
0 siblings, 16 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4828
with the exception of a known autobuilder intermittent issue on qemuppc:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14824
which passed on subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/63/builds/6517
The following changes since commit db81e3c7e7f1d4d9eba52ac35ac97627d0240b63:
build-appliance-image: Update to dunfell head revision (2023-01-13 18:11:40 +0000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (2):
linux-firmware: upgrade 20221109 -> 20221214
selftest/virgl: use pkg-config from the host
Benoît Mauduit (1):
lib/oe/reproducible: Use git log without gpg signature
Bhabu Bindu (1):
ffmpeg: Fix CVE-2022-3109
Hitendra Prajapati (2):
QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can
lead to out-of-bounds read
xserver-xorg: Fix Multiple CVEs
Jan Kircher (1):
toolchain-scripts: compatibility with unbound variable protection
Jermain Horsman (1):
cve-check: write the cve manifest to IMGDEPLOYDIR
Marta Rybczynska (1):
cve-update-db-native: avoid incomplete updates
Niko Mauno (1):
systemd: Consider PACKAGECONFIG in RRECOMMENDS
Quentin Schulz (1):
cairo: fix CVE patches assigned wrong CVE number
Randy MacLeod (1):
vim: upgrade 9.0.0947 -> 9.0.1211
Ross Burton (2):
cve-update-db-native: add more logging when fetching
cve-update-db-native: show IP on failure
Steve Sakoman (1):
python3: fix packaging of Windows distutils installer stubs
jan (1):
cve-update-db-native: Allow to overrule the URL in a bbappend.
meta/classes/cve-check.bbclass | 6 +-
meta/classes/toolchain-scripts.bbclass | 2 +-
meta/lib/oe/reproducible.py | 3 +-
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +-
.../recipes-core/meta/cve-update-db-native.bb | 97 ++++++++++++-----
meta/recipes-core/systemd/systemd_244.5.bb | 4 +-
.../python/python3/python3-manifest.json | 4 +-
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
.../cairo/cairo/CVE-2019-6461.patch | 46 +++-----
.../cairo/cairo/CVE-2019-6462.patch | 46 +++++---
.../xserver-xorg/CVE-2022-4283.patch | 39 +++++++
.../xserver-xorg/CVE-2022-46340.patch | 55 ++++++++++
.../xserver-xorg/CVE-2022-46341.patch | 86 +++++++++++++++
.../xserver-xorg/CVE-2022-46342.patch | 78 +++++++++++++
.../xserver-xorg/CVE-2022-46343.patch | 51 +++++++++
.../xserver-xorg/CVE-2022-46344.patch | 75 +++++++++++++
.../xorg-xserver/xserver-xorg_1.20.14.bb | 8 +-
...20221109.bb => linux-firmware_20221214.bb} | 4 +-
.../ffmpeg/ffmpeg/CVE-2022-3109.patch | 41 +++++++
.../recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 +
meta/recipes-support/vim/vim.inc | 4 +-
22 files changed, 670 insertions(+), 86 deletions(-)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-4283.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46340.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46341.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46342.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46343.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46344.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20221109.bb => linux-firmware_20221214.bb} (99%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-3109.patch
--
2.25.1
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][dunfell 01/16] cve-update-db-native: Allow to overrule the URL in a bbappend.
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 02/16] cve-update-db-native: add more logging when fetching Steve Sakoman
` (14 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: jan <jan.vermaete@gmail.com>
With this small patch, it's possible to overrule the public
URL with a local mirror for those without Internet access.
Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2d903126e8bbece3a5171c3488c3deae1f0aa3ee)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/meta/cve-update-db-native.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index 59e7d7dc2c..355ee2a2a3 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -19,6 +19,7 @@ CVE_DB_UPDATE_INTERVAL ?= "86400"
# Timeout for blocking socket operations, such as the connection attempt.
CVE_SOCKET_TIMEOUT ?= "60"
+NVDCVE_URL ?= "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-"
python () {
if not bb.data.inherits_class("cve-check", d):
@@ -36,7 +37,6 @@ python do_fetch() {
bb.utils.export_proxies(d)
- BASE_URL = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-"
YEAR_START = 2002
db_file = d.getVar("CVE_CHECK_DB_FILE")
@@ -76,7 +76,7 @@ python do_fetch() {
total_years = date.today().year + 1 - YEAR_START
for i, year in enumerate(range(YEAR_START, date.today().year + 1)):
ph.update((float(i + 1) / total_years) * 100)
- year_url = BASE_URL + str(year)
+ year_url = (d.getVar('NVDCVE_URL')) + str(year)
meta_url = year_url + ".meta"
json_url = year_url + ".json.gz"
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 02/16] cve-update-db-native: add more logging when fetching
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 01/16] cve-update-db-native: Allow to overrule the URL in a bbappend Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 03/16] cve-update-db-native: avoid incomplete updates Steve Sakoman
` (13 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
Add some debug logging when fetching the CVE data.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9b230584664873af2ab453b8153b1ad276d3b0af)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/meta/cve-update-db-native.bb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index 355ee2a2a3..e267671628 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -75,6 +75,7 @@ python do_fetch() {
with bb.progress.ProgressHandler(d) as ph, open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a') as cve_f:
total_years = date.today().year + 1 - YEAR_START
for i, year in enumerate(range(YEAR_START, date.today().year + 1)):
+ bb.debug(2, "Updating %d" % year)
ph.update((float(i + 1) / total_years) * 100)
year_url = (d.getVar('NVDCVE_URL')) + str(year)
meta_url = year_url + ".meta"
@@ -104,6 +105,7 @@ python do_fetch() {
cursor.close()
if not meta or meta[0] != last_modified:
+ bb.debug(2, "Updating entries")
# Clear products table entries corresponding to current year
conn.execute("delete from PRODUCTS where ID like ?", ('CVE-%d%%' % year,)).close()
@@ -117,7 +119,8 @@ python do_fetch() {
cve_f.write('Warning: CVE db update error, CVE data is outdated.\n\n')
bb.warn("Cannot parse CVE data (%s), update failed" % e.reason)
return
-
+ else:
+ bb.debug(2, "Already up to date (last modified %s)" % last_modified)
# Update success, set the date to cve_check file.
if year == date.today().year:
cve_f.write('CVE database update : %s\n\n' % date.today())
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 03/16] cve-update-db-native: avoid incomplete updates
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 01/16] cve-update-db-native: Allow to overrule the URL in a bbappend Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 02/16] cve-update-db-native: add more logging when fetching Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 04/16] cve-update-db-native: show IP on failure Steve Sakoman
` (12 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Marta Rybczynska <rybczynska@gmail.com>
The database update has been done on the original file. In case of
network connection issues, temporary outage of the NVD server or
a similar situation, the function could exit with incomplete data
in the database. This patch solves the issue by performing the update
on a copy of the database. It replaces the main one only if the whole
update was successful.
See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14929
Reported-by: Alberto Pianon <alberto@pianon.eu>
Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8efe99214d8b005f0ecac690ce5ba17b31758f92)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../recipes-core/meta/cve-update-db-native.bb | 83 ++++++++++++++-----
1 file changed, 61 insertions(+), 22 deletions(-)
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index e267671628..28605bc13b 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -21,6 +21,8 @@ CVE_DB_UPDATE_INTERVAL ?= "86400"
CVE_SOCKET_TIMEOUT ?= "60"
NVDCVE_URL ?= "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-"
+CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_1.1.db"
+
python () {
if not bb.data.inherits_class("cve-check", d):
raise bb.parse.SkipRecipe("Skip recipe when cve-check class is not loaded.")
@@ -32,25 +34,15 @@ python do_fetch() {
"""
import bb.utils
import bb.progress
- import sqlite3, urllib, urllib.parse, shutil, gzip
- from datetime import date
+ import shutil
bb.utils.export_proxies(d)
- YEAR_START = 2002
-
db_file = d.getVar("CVE_CHECK_DB_FILE")
db_dir = os.path.dirname(db_file)
+ db_tmp_file = d.getVar("CVE_DB_TEMP_FILE")
- cve_socket_timeout = int(d.getVar("CVE_SOCKET_TIMEOUT"))
-
- if os.path.exists("{0}-journal".format(db_file)):
- # If a journal is present the last update might have been interrupted. In that case,
- # just wipe any leftovers and force the DB to be recreated.
- os.remove("{0}-journal".format(db_file))
-
- if os.path.exists(db_file):
- os.remove(db_file)
+ cleanup_db_download(db_file, db_tmp_file)
# The NVD database changes once a day, so no need to update more frequently
# Allow the user to force-update
@@ -67,9 +59,60 @@ python do_fetch() {
pass
bb.utils.mkdirhier(db_dir)
+ if os.path.exists(db_file):
+ shutil.copy2(db_file, db_tmp_file)
+
+ if update_db_file(db_tmp_file, d) == True:
+ # Update downloaded correctly, can swap files
+ shutil.move(db_tmp_file, db_file)
+ else:
+ # Update failed, do not modify the database
+ bb.note("CVE database update failed")
+ os.remove(db_tmp_file)
+}
+
+do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}"
+do_fetch[file-checksums] = ""
+do_fetch[vardeps] = ""
+
+def cleanup_db_download(db_file, db_tmp_file):
+ """
+ Cleanup the download space from possible failed downloads
+ """
+
+ # Clean up the updates done on the main file
+ # Remove it only if a journal file exists - it means a complete re-download
+ if os.path.exists("{0}-journal".format(db_file)):
+ # If a journal is present the last update might have been interrupted. In that case,
+ # just wipe any leftovers and force the DB to be recreated.
+ os.remove("{0}-journal".format(db_file))
+
+ if os.path.exists(db_file):
+ os.remove(db_file)
+
+ # Clean-up the temporary file downloads, we can remove both journal
+ # and the temporary database
+ if os.path.exists("{0}-journal".format(db_tmp_file)):
+ # If a journal is present the last update might have been interrupted. In that case,
+ # just wipe any leftovers and force the DB to be recreated.
+ os.remove("{0}-journal".format(db_tmp_file))
+
+ if os.path.exists(db_tmp_file):
+ os.remove(db_tmp_file)
+
+def update_db_file(db_tmp_file, d):
+ """
+ Update the given database file
+ """
+ import bb.utils, bb.progress
+ from datetime import date
+ import urllib, gzip, sqlite3
+
+ YEAR_START = 2002
+ cve_socket_timeout = int(d.getVar("CVE_SOCKET_TIMEOUT"))
# Connect to database
- conn = sqlite3.connect(db_file)
+ conn = sqlite3.connect(db_tmp_file)
initialize_db(conn)
with bb.progress.ProgressHandler(d) as ph, open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a') as cve_f:
@@ -87,7 +130,7 @@ python do_fetch() {
except urllib.error.URLError as e:
cve_f.write('Warning: CVE db update error, Unable to fetch CVE data.\n\n')
bb.warn("Failed to fetch CVE data (%s)" % e.reason)
- return
+ return False
if response:
for l in response.read().decode("utf-8").splitlines():
@@ -97,7 +140,7 @@ python do_fetch() {
break
else:
bb.warn("Cannot parse CVE metadata, update failed")
- return
+ return False
# Compare with current db last modified date
cursor = conn.execute("select DATE from META where YEAR = ?", (year,))
@@ -118,7 +161,7 @@ python do_fetch() {
except urllib.error.URLError as e:
cve_f.write('Warning: CVE db update error, CVE data is outdated.\n\n')
bb.warn("Cannot parse CVE data (%s), update failed" % e.reason)
- return
+ return False
else:
bb.debug(2, "Already up to date (last modified %s)" % last_modified)
# Update success, set the date to cve_check file.
@@ -127,11 +170,7 @@ python do_fetch() {
conn.commit()
conn.close()
-}
-
-do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}"
-do_fetch[file-checksums] = ""
-do_fetch[vardeps] = ""
+ return True
def initialize_db(conn):
with conn:
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 04/16] cve-update-db-native: show IP on failure
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 03/16] cve-update-db-native: avoid incomplete updates Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 05/16] cve-check: write the cve manifest to IMGDEPLOYDIR Steve Sakoman
` (11 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
We get random SSL failures when fetching the CVE database, and it's
notable that the NVD server is behind a DNS round-robin or geographically
diverse servers.
On a hunch that there is one misconfigured server, dump the IP that we
connected to.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 91f46d431dc8f40e8c6475c800bb61cb08b82b0a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/meta/cve-update-db-native.bb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index 28605bc13b..efc32470d3 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -129,7 +129,10 @@ def update_db_file(db_tmp_file, d):
response = urllib.request.urlopen(meta_url, timeout=cve_socket_timeout)
except urllib.error.URLError as e:
cve_f.write('Warning: CVE db update error, Unable to fetch CVE data.\n\n')
- bb.warn("Failed to fetch CVE data (%s)" % e.reason)
+ bb.warn("Failed to fetch CVE data (%s)" % e)
+ import socket
+ result = socket.getaddrinfo("nvd.nist.gov", 443, proto=socket.IPPROTO_TCP)
+ bb.warn("Host IPs are %s" % (", ".join(t[4][0] for t in result)))
return False
if response:
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 05/16] cve-check: write the cve manifest to IMGDEPLOYDIR
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 04/16] cve-update-db-native: show IP on failure Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 06/16] cairo: fix CVE patches assigned wrong CVE number Steve Sakoman
` (10 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Jermain Horsman <jermain.horsman@nedap.com>
When building an image cve_check_write_rootfs_manifest() would sometimes fail
with a FileNotFoundError when writing the manifest.cve due to the parent
directory (DEPLOY_DIR_IMAGE) not (yet) existing.
The image task will provide the manifest in the deploy directory afterwards,
so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should
continue to function properly.
Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 4fc4e545e4..87a59d5c6d 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -42,8 +42,8 @@ CVE_CHECK_LOG_JSON ?= "${T}/cve.json"
CVE_CHECK_DIR ??= "${DEPLOY_DIR}/cve"
CVE_CHECK_RECIPE_FILE ?= "${CVE_CHECK_DIR}/${PN}"
CVE_CHECK_RECIPE_FILE_JSON ?= "${CVE_CHECK_DIR}/${PN}_cve.json"
-CVE_CHECK_MANIFEST ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cve"
-CVE_CHECK_MANIFEST_JSON ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.json"
+CVE_CHECK_MANIFEST ?= "${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cve"
+CVE_CHECK_MANIFEST_JSON ?= "${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.json"
CVE_CHECK_COPY_FILES ??= "1"
CVE_CHECK_CREATE_MANIFEST ??= "1"
@@ -195,7 +195,7 @@ python cve_check_write_rootfs_manifest () {
recipies.add(pkg_data["PN"])
bb.note("Writing rootfs CVE manifest")
- deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
+ deploy_dir = d.getVar("IMGDEPLOYDIR")
link_name = d.getVar("IMAGE_LINK_NAME")
json_data = {"version":"1", "package": []}
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 06/16] cairo: fix CVE patches assigned wrong CVE number
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 05/16] cve-check: write the cve manifest to IMGDEPLOYDIR Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read Steve Sakoman
` (9 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
CVE-2019-6461 and CVE-2019-6462 are fixed, but the reporting is
incorrect as the patch for CVE-2019-6461 is actually for CVE-2019-6462
and vice-versa.
This swaps both files and edit the CVE field to report the correct
identifier.
Cc: Quentin Schulz <foss+yocto@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f12c2a5ac94cb29f473f3c7e335463c7fb6d8a6e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../cairo/cairo/CVE-2019-6461.patch | 46 ++++++-------------
.../cairo/cairo/CVE-2019-6462.patch | 46 +++++++++++++------
2 files changed, 46 insertions(+), 46 deletions(-)
diff --git a/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch b/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch
index 0b7d9a0c36..a2dba6cb20 100644
--- a/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch
+++ b/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch
@@ -1,40 +1,20 @@
-CVE: CVE-2019-6461
-Upstream-Status: Backport
-Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
-
-From ab2c5ee21e5f3d3ee4b3f67cfcd5811a4f99c3a0 Mon Sep 17 00:00:00 2001
-From: Heiko Lewin <hlewin@gmx.de>
-Date: Sun, 1 Aug 2021 11:16:03 +0000
-Subject: [PATCH] _arc_max_angle_for_tolerance_normalized: fix infinite loop
+There is an assertion in function _cairo_arc_in_direction().
----
- src/cairo-arc.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
+CVE: CVE-2019-6461
+Upstream-Status: Pending
+Signed-off-by: Ross Burton <ross.burton@intel.com>
diff --git a/src/cairo-arc.c b/src/cairo-arc.c
-index 390397bae..1c891d1a0 100644
+index 390397bae..1bde774a4 100644
--- a/src/cairo-arc.c
+++ b/src/cairo-arc.c
-@@ -90,16 +90,18 @@ _arc_max_angle_for_tolerance_normalized (double tolerance)
- { M_PI / 11.0, 9.81410988043554039085e-09 },
- };
- int table_size = ARRAY_LENGTH (table);
-+ const int max_segments = 1000; /* this value is chosen arbitrarily. this gives an error of about 1.74909e-20 */
+@@ -186,7 +186,8 @@ _cairo_arc_in_direction (cairo_t *cr,
+ if (cairo_status (cr))
+ return;
- for (i = 0; i < table_size; i++)
- if (table[i].error < tolerance)
- return table[i].angle;
+- assert (angle_max >= angle_min);
++ if (angle_max < angle_min)
++ return;
- ++i;
-+
- do {
- angle = M_PI / i++;
- error = _arc_error_normalized (angle);
-- } while (error > tolerance);
-+ } while (error > tolerance && i < max_segments);
-
- return angle;
- }
---
-2.38.1
-
+ if (angle_max - angle_min > 2 * M_PI * MAX_FULL_CIRCLES) {
+ angle_max = fmod (angle_max - angle_min, 2 * M_PI);
diff --git a/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch b/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch
index 4e4598c5b5..7c3209291b 100644
--- a/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch
+++ b/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch
@@ -1,20 +1,40 @@
-There is an assertion in function _cairo_arc_in_direction().
-
CVE: CVE-2019-6462
-Upstream-Status: Pending
-Signed-off-by: Ross Burton <ross.burton@intel.com>
+Upstream-Status: Backport
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+From ab2c5ee21e5f3d3ee4b3f67cfcd5811a4f99c3a0 Mon Sep 17 00:00:00 2001
+From: Heiko Lewin <hlewin@gmx.de>
+Date: Sun, 1 Aug 2021 11:16:03 +0000
+Subject: [PATCH] _arc_max_angle_for_tolerance_normalized: fix infinite loop
+
+---
+ src/cairo-arc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/cairo-arc.c b/src/cairo-arc.c
-index 390397bae..1bde774a4 100644
+index 390397bae..1c891d1a0 100644
--- a/src/cairo-arc.c
+++ b/src/cairo-arc.c
-@@ -186,7 +186,8 @@ _cairo_arc_in_direction (cairo_t *cr,
- if (cairo_status (cr))
- return;
+@@ -90,16 +90,18 @@ _arc_max_angle_for_tolerance_normalized (double tolerance)
+ { M_PI / 11.0, 9.81410988043554039085e-09 },
+ };
+ int table_size = ARRAY_LENGTH (table);
++ const int max_segments = 1000; /* this value is chosen arbitrarily. this gives an error of about 1.74909e-20 */
-- assert (angle_max >= angle_min);
-+ if (angle_max < angle_min)
-+ return;
+ for (i = 0; i < table_size; i++)
+ if (table[i].error < tolerance)
+ return table[i].angle;
- if (angle_max - angle_min > 2 * M_PI * MAX_FULL_CIRCLES) {
- angle_max = fmod (angle_max - angle_min, 2 * M_PI);
+ ++i;
++
+ do {
+ angle = M_PI / i++;
+ error = _arc_error_normalized (angle);
+- } while (error > tolerance);
++ } while (error > tolerance && i < max_segments);
+
+ return angle;
+ }
+--
+2.38.1
+
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (5 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 06/16] cairo: fix CVE patches assigned wrong CVE number Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-31 7:18 ` Martin Jansa
[not found] ` <173F539A3738DDDD.25384@lists.openembedded.org>
2023-01-25 14:41 ` [OE-core][dunfell 08/16] ffmpeg: Fix CVE-2022-3109 Steve Sakoman
` (8 subsequent siblings)
15 siblings, 2 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
2 files changed, 104 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index fff2c87780..898fa1a8d8 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -115,6 +115,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2021-3638.patch \
file://CVE-2021-20196.patch \
file://CVE-2021-3507.patch \
+ file://CVE-2022-4144.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
new file mode 100644
index 0000000000..3f0d5fbd5c
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
@@ -0,0 +1,103 @@
+From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
+Date: Mon, 28 Nov 2022 21:27:40 +0100
+Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
+ (CVE-2022-4144)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Have qxl_get_check_slot_offset() return false if the requested
+buffer size does not fit within the slot memory region.
+
+Similarly qxl_phys2virt() now returns NULL in such case, and
+qxl_dirty_one_surface() aborts.
+
+This avoids buffer overrun in the host pointer returned by
+memory_region_get_ram_ptr().
+
+Fixes: CVE-2022-4144 (out-of-bounds read)
+Reported-by: Wenxu Yin (@awxylitol)
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
+
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-Id: <20221128202741.4945-5-philmd@linaro.org>
+
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622]
+CVE: CVE-2022-4144
+Comments: Deleted patch hunk in qxl.h,as it contains change
+in comments which is not present in current version of qemu.
+
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ hw/display/qxl.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/hw/display/qxl.c b/hw/display/qxl.c
+index cd7eb39d..6bc8385b 100644
+--- a/hw/display/qxl.c
++++ b/hw/display/qxl.c
+@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
+
+ /* can be also called from spice server thread context */
+ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
+- uint32_t *s, uint64_t *o)
++ uint32_t *s, uint64_t *o,
++ size_t size_requested)
+ {
+ uint64_t phys = le64_to_cpu(pqxl);
+ uint32_t slot = (phys >> (64 - 8)) & 0xff;
+ uint64_t offset = phys & 0xffffffffffff;
++ uint64_t size_available;
+
+ if (slot >= NUM_MEMSLOTS) {
+ qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
+@@ -1468,6 +1470,23 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
+ slot, offset, qxl->guest_slots[slot].size);
+ return false;
+ }
++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
++ qxl_set_guest_bug(qxl,
++ "slot %d offset %"PRIu64" > region size %"PRIu64"\n",
++ slot, qxl->guest_slots[slot].offset + offset,
++ size_available);
++ return false;
++ }
++ size_available -= qxl->guest_slots[slot].offset + offset;
++ if (size_requested > size_available) {
++ qxl_set_guest_bug(qxl,
++ "slot %d offset %"PRIu64" size %zu: "
++ "overrun by %"PRIu64" bytes\n",
++ slot, offset, size_requested,
++ size_requested - size_available);
++ return false;
++ }
+
+ *s = slot;
+ *o = offset;
+@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
+ offset = le64_to_cpu(pqxl) & 0xffffffffffff;
+ return (void *)(intptr_t)offset;
+ case MEMSLOT_GROUP_GUEST:
+- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
+ return NULL;
+ }
+ ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
+@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
+ uint32_t slot;
+ bool rc;
+
+- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
+- assert(rc == true);
+ size = (uint64_t)height * abs(stride);
++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
++ assert(rc == true);
+ trace_qxl_surfaces_dirty(qxl->id, offset, size);
+ qxl_set_dirty(qxl->guest_slots[slot].mr,
+ qxl->guest_slots[slot].offset + offset,
+--
+2.25.1
+
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 08/16] ffmpeg: Fix CVE-2022-3109
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (6 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 09/16] xserver-xorg: Fix Multiple CVEs Steve Sakoman
` (7 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Bhabu Bindu <bhabu.bindu@kpit.com>
Add patch to fix CVE-2022-3109
Link: https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568
Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2022-3109.patch | 41 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-3109.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-3109.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-3109.patch
new file mode 100644
index 0000000000..febf49cff2
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-3109.patch
@@ -0,0 +1,41 @@
+From 656cb0450aeb73b25d7d26980af342b37ac4c568 Mon Sep 17 00:00:00 2001
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Date: Tue, 15 Feb 2022 17:58:08 +0800
+Subject: [PATCH] avcodec/vp3: Add missing check for av_malloc
+
+Since the av_malloc() may fail and return NULL pointer,
+it is needed that the 's->edge_emu_buffer' should be checked
+whether the new allocation is success.
+
+Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
+
+CVE: CVE-2022-3109
+Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568]
+Comments: Refreshed hunk
+
+Reviewed-by: Peter Ross <pross@xvid.org>
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
+---
+ libavcodec/vp3.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
+index e9ab54d73677..e2418eb6fa04 100644
+--- a/libavcodec/vp3.c
++++ b/libavcodec/vp3.c
+@@ -2740,8 +2740,13 @@
+ if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0)
+ goto error;
+
+- if (!s->edge_emu_buffer)
++ if (!s->edge_emu_buffer) {
+ s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize[0]));
++ if (!s->edge_emu_buffer) {
++ ret = AVERROR(ENOMEM);
++ goto error;
++ }
++ }
+
+ if (s->keyframe) {
+ if (!s->theora) {
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
index cbfdbf0563..ffeec92e0e 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
@@ -30,6 +30,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
file://CVE-2021-3566.patch \
file://CVE-2021-38291.patch \
file://CVE-2022-1475.patch \
+ file://CVE-2022-3109.patch \
"
SRC_URI[md5sum] = "348956fc2faa57a2f79bbb84ded9fbc3"
SRC_URI[sha256sum] = "cb754255ab0ee2ea5f66f8850e1bd6ad5cac1cd855d0a2f4990fb8c668b0d29c"
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 09/16] xserver-xorg: Fix Multiple CVEs
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (7 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 08/16] ffmpeg: Fix CVE-2022-3109 Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 10/16] linux-firmware: upgrade 20221109 -> 20221214 Steve Sakoman
` (6 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
CVE-2022-4283: xkb: reset the radio_groups pointer to NULL after freeing it
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c
CVE-2022-46340: Xtest: disallow GenericEvents in XTestSwapFakeInput
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63
CVE-2022-46341: Xi: disallow passive grabs with a detail > 255
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/51eb63b0ee1509c6c6b8922b0e4aa037faa6f78b
CVE-2022-46342: Xext: free the XvRTVideoNotify when turning off from the same client
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/b79f32b57cc0c1186b2899bce7cf89f7b325161b
CVE-2022-46343: Xext: free the screen saver resource when replacing it
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/842ca3ccef100ce010d1d8f5f6d6cc1915055900
CVE-2022-46344: Xi: avoid integer truncation in length check of ProcXIChangeProperty
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/8f454b793e1f13c99872c15f0eed1d7f3b823fe8
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xserver-xorg/CVE-2022-4283.patch | 39 +++++++++
.../xserver-xorg/CVE-2022-46340.patch | 55 ++++++++++++
.../xserver-xorg/CVE-2022-46341.patch | 86 +++++++++++++++++++
.../xserver-xorg/CVE-2022-46342.patch | 78 +++++++++++++++++
.../xserver-xorg/CVE-2022-46343.patch | 51 +++++++++++
.../xserver-xorg/CVE-2022-46344.patch | 75 ++++++++++++++++
.../xorg-xserver/xserver-xorg_1.20.14.bb | 8 +-
7 files changed, 391 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-4283.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46340.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46341.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46342.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46343.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46344.patch
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-4283.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-4283.patch
new file mode 100644
index 0000000000..3f6b68fea8
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-4283.patch
@@ -0,0 +1,39 @@
+From ccdd431cd8f1cabae9d744f0514b6533c438908c Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 5 Dec 2022 15:55:54 +1000
+Subject: [PATCH] xkb: reset the radio_groups pointer to NULL after freeing it
+
+Unlike other elements of the keymap, this pointer was freed but not
+reset. On a subsequent XkbGetKbdByName request, the server may access
+already freed memory.
+
+CVE-2022-4283, ZDI-CAN-19530
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c]
+CVE: CVE-2022-4283
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ xkb/xkbUtils.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
+index 8975ade..9bc51fc 100644
+--- a/xkb/xkbUtils.c
++++ b/xkb/xkbUtils.c
+@@ -1327,6 +1327,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
+ }
+ else {
+ free(dst->names->radio_groups);
++ dst->names->radio_groups = NULL;
+ }
+ dst->names->num_rg = src->names->num_rg;
+
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46340.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46340.patch
new file mode 100644
index 0000000000..a6c97485cd
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46340.patch
@@ -0,0 +1,55 @@
+From b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 12:55:45 +1000
+Subject: [PATCH] Xtest: disallow GenericEvents in XTestSwapFakeInput
+
+XTestSwapFakeInput assumes all events in this request are
+sizeof(xEvent) and iterates through these in 32-byte increments.
+However, a GenericEvent may be of arbitrary length longer than 32 bytes,
+so any GenericEvent in this list would result in subsequent events to be
+misparsed.
+
+Additional, the swapped event is written into a stack-allocated struct
+xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes,
+swapping the event may thus smash the stack like an avocado on toast.
+
+Catch this case early and return BadValue for any GenericEvent.
+Which is what would happen in unswapped setups anyway since XTest
+doesn't support GenericEvent.
+
+CVE-2022-46340, ZDI-CAN 19265
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63]
+CVE: CVE-2022-46340
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ Xext/xtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Xext/xtest.c b/Xext/xtest.c
+index 38b8012..bf11789 100644
+--- a/Xext/xtest.c
++++ b/Xext/xtest.c
+@@ -501,10 +501,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
+
+ nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
+ for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
++ int evtype = ev->u.u.type & 0x177;
+ /* Swap event */
+- proc = EventSwapVector[ev->u.u.type & 0177];
++ proc = EventSwapVector[evtype];
+ /* no swapping proc; invalid event type? */
+- if (!proc || proc == NotImplemented) {
++ if (!proc || proc == NotImplemented || evtype == GenericEvent) {
+ client->errorValue = ev->u.u.type;
+ return BadValue;
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46341.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46341.patch
new file mode 100644
index 0000000000..0ef6e5fc9f
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46341.patch
@@ -0,0 +1,86 @@
+From 51eb63b0ee1509c6c6b8922b0e4aa037faa6f78b Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 13:55:32 +1000
+Subject: [PATCH] Xi: disallow passive grabs with a detail > 255
+
+The XKB protocol effectively prevents us from ever using keycodes above
+255. For buttons it's theoretically possible but realistically too niche
+to worry about. For all other passive grabs, the detail must be zero
+anyway.
+
+This fixes an OOB write:
+
+ProcXIPassiveUngrabDevice() calls DeletePassiveGrabFromList with a
+temporary grab struct which contains tempGrab->detail.exact = stuff->detail.
+For matching existing grabs, DeleteDetailFromMask is called with the
+stuff->detail value. This function creates a new mask with the one bit
+representing stuff->detail cleared.
+
+However, the array size for the new mask is 8 * sizeof(CARD32) bits,
+thus any detail above 255 results in an OOB array write.
+
+CVE-2022-46341, ZDI-CAN 19381
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/51eb63b0ee1509c6c6b8922b0e4aa037faa6f78b]
+CVE: CVE-2022-46341
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ Xi/xipassivegrab.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
+index d30f51f..89a5910 100644
+--- a/Xi/xipassivegrab.c
++++ b/Xi/xipassivegrab.c
+@@ -133,6 +133,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+ return BadValue;
+ }
+
++ /* XI2 allows 32-bit keycodes but thanks to XKB we can never
++ * implement this. Just return an error for all keycodes that
++ * cannot work anyway, same for buttons > 255. */
++ if (stuff->detail > 255)
++ return XIAlreadyGrabbed;
++
+ if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
+ stuff->mask_len * 4) != Success)
+ return BadValue;
+@@ -203,14 +209,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+ ¶m, XI2, &mask);
+ break;
+ case XIGrabtypeKeycode:
+- /* XI2 allows 32-bit keycodes but thanks to XKB we can never
+- * implement this. Just return an error for all keycodes that
+- * cannot work anyway */
+- if (stuff->detail > 255)
+- status = XIAlreadyGrabbed;
+- else
+- status = GrabKey(client, dev, mod_dev, stuff->detail,
+- ¶m, XI2, &mask);
++ status = GrabKey(client, dev, mod_dev, stuff->detail,
++ ¶m, XI2, &mask);
+ break;
+ case XIGrabtypeEnter:
+ case XIGrabtypeFocusIn:
+@@ -319,6 +319,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
+ return BadValue;
+ }
+
++ /* We don't allow passive grabs for details > 255 anyway */
++ if (stuff->detail > 255) {
++ client->errorValue = stuff->detail;
++ return BadValue;
++ }
++
+ rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess);
+ if (rc != Success)
+ return rc;
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46342.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46342.patch
new file mode 100644
index 0000000000..23fef3f321
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46342.patch
@@ -0,0 +1,78 @@
+From b79f32b57cc0c1186b2899bce7cf89f7b325161b Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 30 Nov 2022 11:20:40 +1000
+Subject: [PATCH] Xext: free the XvRTVideoNotify when turning off from the same
+ client
+
+This fixes a use-after-free bug:
+
+When a client first calls XvdiSelectVideoNotify() on a drawable with a
+TRUE onoff argument, a struct XvVideoNotifyRec is allocated. This struct
+is added twice to the resources:
+ - as the drawable's XvRTVideoNotifyList. This happens only once per
+ drawable, subsequent calls append to this list.
+ - as the client's XvRTVideoNotify. This happens for every client.
+
+The struct keeps the ClientPtr around once it has been added for a
+client. The idea, presumably, is that if the client disconnects we can remove
+all structs from the drawable's list that match the client (by resetting
+the ClientPtr to NULL), but if the drawable is destroyed we can remove
+and free the whole list.
+
+However, if the same client then calls XvdiSelectVideoNotify() on the
+same drawable with a FALSE onoff argument, only the ClientPtr on the
+existing struct was set to NULL. The struct itself remained in the
+client's resources.
+
+If the drawable is now destroyed, the resource system invokes
+XvdiDestroyVideoNotifyList which frees the whole list for this drawable
+- including our struct. This function however does not free the resource
+for the client since our ClientPtr is NULL.
+
+Later, when the client is destroyed and the resource system invokes
+XvdiDestroyVideoNotify, we unconditionally set the ClientPtr to NULL. On
+a struct that has been freed previously. This is generally frowned upon.
+
+Fix this by calling FreeResource() on the second call instead of merely
+setting the ClientPtr to NULL. This removes the struct from the client
+resources (but not from the list), ensuring that it won't be accessed
+again when the client quits.
+
+Note that the assignment tpn->client = NULL; is superfluous since the
+XvdiDestroyVideoNotify function will do this anyway. But it's left for
+clarity and to match a similar invocation in XvdiSelectPortNotify.
+
+CVE-2022-46342, ZDI-CAN 19400
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b79f32b57cc0c1186b2899bce7cf89f7b325161b]
+CVE: CVE-2022-46342
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ Xext/xvmain.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Xext/xvmain.c b/Xext/xvmain.c
+index c520c7d..5f4c174 100644
+--- a/Xext/xvmain.c
++++ b/Xext/xvmain.c
+@@ -811,8 +811,10 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff)
+ tpn = pn;
+ while (tpn) {
+ if (tpn->client == client) {
+- if (!onoff)
++ if (!onoff) {
+ tpn->client = NULL;
++ FreeResource(tpn->id, XvRTVideoNotify);
++ }
+ return Success;
+ }
+ if (!tpn->client)
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46343.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46343.patch
new file mode 100644
index 0000000000..838f7d3726
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46343.patch
@@ -0,0 +1,51 @@
+From 842ca3ccef100ce010d1d8f5f6d6cc1915055900 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 14:53:07 +1000
+Subject: [PATCH] Xext: free the screen saver resource when replacing it
+
+This fixes a use-after-free bug:
+
+When a client first calls ScreenSaverSetAttributes(), a struct
+ScreenSaverAttrRec is allocated and added to the client's
+resources.
+
+When the same client calls ScreenSaverSetAttributes() again, a new
+struct ScreenSaverAttrRec is allocated, replacing the old struct. The
+old struct was freed but not removed from the clients resources.
+
+Later, when the client is destroyed the resource system invokes
+ScreenSaverFreeAttr and attempts to clean up the already freed struct.
+
+Fix this by letting the resource system free the old attrs instead.
+
+CVE-2022-46343, ZDI-CAN 19404
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/842ca3ccef100ce010d1d8f5f6d6cc1915055900]
+CVE: CVE-2022-46343
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ Xext/saver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/saver.c b/Xext/saver.c
+index c23907d..05b9ca3 100644
+--- a/Xext/saver.c
++++ b/Xext/saver.c
+@@ -1051,7 +1051,7 @@ ScreenSaverSetAttributes(ClientPtr client)
+ pVlist++;
+ }
+ if (pPriv->attr)
+- FreeScreenAttr(pPriv->attr);
++ FreeResource(pPriv->attr->resource, AttrType);
+ pPriv->attr = pAttr;
+ pAttr->resource = FakeClientID(client->index);
+ if (!AddResource(pAttr->resource, AttrType, (void *) pAttr))
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46344.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46344.patch
new file mode 100644
index 0000000000..e25afa0d16
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-46344.patch
@@ -0,0 +1,75 @@
+From 8f454b793e1f13c99872c15f0eed1d7f3b823fe8 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 13:26:57 +1000
+Subject: [PATCH] Xi: avoid integer truncation in length check of
+ ProcXIChangeProperty
+
+This fixes an OOB read and the resulting information disclosure.
+
+Length calculation for the request was clipped to a 32-bit integer. With
+the correct stuff->num_items value the expected request size was
+truncated, passing the REQUEST_FIXED_SIZE check.
+
+The server then proceeded with reading at least stuff->num_items bytes
+(depending on stuff->format) from the request and stuffing whatever it
+finds into the property. In the process it would also allocate at least
+stuff->num_items bytes, i.e. 4GB.
+
+The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
+so let's fix that too.
+
+CVE-2022-46344, ZDI-CAN 19405
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/8f454b793e1f13c99872c15f0eed1d7f3b823fe8]
+CVE: CVE-2022-46344
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ Xi/xiproperty.c | 4 ++--
+ dix/property.c | 3 ++-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index 6ec419e..0cfa6e3 100644
+--- a/Xi/xiproperty.c
++++ b/Xi/xiproperty.c
+@@ -890,7 +890,7 @@ ProcXChangeDeviceProperty(ClientPtr client)
+ REQUEST(xChangeDevicePropertyReq);
+ DeviceIntPtr dev;
+ unsigned long len;
+- int totalSize;
++ uint64_t totalSize;
+ int rc;
+
+ REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
+@@ -1128,7 +1128,7 @@ ProcXIChangeProperty(ClientPtr client)
+ {
+ int rc;
+ DeviceIntPtr dev;
+- int totalSize;
++ uint64_t totalSize;
+ unsigned long len;
+
+ REQUEST(xXIChangePropertyReq);
+diff --git a/dix/property.c b/dix/property.c
+index ff1d669..6fdb74a 100644
+--- a/dix/property.c
++++ b/dix/property.c
+@@ -205,7 +205,8 @@ ProcChangeProperty(ClientPtr client)
+ WindowPtr pWin;
+ char format, mode;
+ unsigned long len;
+- int sizeInBytes, totalSize, err;
++ int sizeInBytes, err;
++ uint64_t totalSize;
+
+ REQUEST(xChangePropertyReq);
+
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb
index 4f5528f78b..ab18a87a3d 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb
@@ -8,7 +8,13 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat
file://CVE-2022-3550.patch \
file://CVE-2022-3551.patch \
file://CVE-2022-3553.patch \
- "
+ file://CVE-2022-4283.patch \
+ file://CVE-2022-46340.patch \
+ file://CVE-2022-46341.patch \
+ file://CVE-2022-46342.patch \
+ file://CVE-2022-46343.patch \
+ file://CVE-2022-46344.patch \
+"
SRC_URI[md5sum] = "453fc86aac8c629b3a5b77e8dcca30bf"
SRC_URI[sha256sum] = "54b199c9280ff8bf0f73a54a759645bd0eeeda7255d1c99310d5b7595f3ac066"
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 10/16] linux-firmware: upgrade 20221109 -> 20221214
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (8 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 09/16] xserver-xorg: Fix Multiple CVEs Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 11/16] vim: upgrade 9.0.0947 -> 9.0.1211 Steve Sakoman
` (5 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
License-Update: additional files
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 15f3a9f6c4406ddc00f7dc0ca7e1beafe9c71a9f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...{linux-firmware_20221109.bb => linux-firmware_20221214.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20221109.bb => linux-firmware_20221214.bb} (99%)
diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20221109.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20221214.bb
similarity index 99%
rename from meta/recipes-kernel/linux-firmware/linux-firmware_20221109.bb
rename to meta/recipes-kernel/linux-firmware/linux-firmware_20221214.bb
index 8c132c8f34..e3105053c7 100644
--- a/meta/recipes-kernel/linux-firmware/linux-firmware_20221109.bb
+++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20221214.bb
@@ -132,7 +132,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \
"
# WHENCE checksum is defined separately to ease overriding it if
# class-devupstream is selected.
-WHENCE_CHKSUM = "ab4ba608dc4b757716871f9be033f0f1"
+WHENCE_CHKSUM = "bf7c716d16e48fe118c6209f99b13253"
# These are not common licenses, set NO_GENERIC_LICENSE for them
# so that the license files will be copied from fetched source
@@ -209,7 +209,7 @@ SRC_URI:class-devupstream = "git://git.kernel.org/pub/scm/linux/kernel/git/firmw
# Pin this to the 20220509 release, override this in local.conf
SRCREV:class-devupstream ?= "b19cbdca78ab2adfd210c91be15a22568e8b8cae"
-SRC_URI[sha256sum] = "c0ddffbbcf30f2e015bddd5c6d3ce1f13976b906aceabda4a57e3c41a3190701"
+SRC_URI[sha256sum] = "e793783e92acbde549965521462d1d1327827360664cf242dbda08f075654331"
inherit allarch
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 11/16] vim: upgrade 9.0.0947 -> 9.0.1211
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (9 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 10/16] linux-firmware: upgrade 20221109 -> 20221214 Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 12/16] systemd: Consider PACKAGECONFIG in RRECOMMENDS Steve Sakoman
` (4 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Randy MacLeod <randy.macleod@windriver.com>
Includes fixes for:
https://nvd.nist.gov/vuln/detail/CVE-2023-0049
https://nvd.nist.gov/vuln/detail/CVE-2023-0051
https://nvd.nist.gov/vuln/detail/CVE-2023-0054
https://nvd.nist.gov/vuln/detail/CVE-2023-0288
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/vim/vim.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 1e5ef1c811..46250c0d37 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -20,8 +20,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://no-path-adjust.patch \
"
-PV .= ".0947"
-SRCREV = "cc762a48d42b579fb7bdec2c614636b830342dd5"
+PV .= ".1211"
+SRCREV = "f7d1c6e1884c76680980571f1cf15e0928d247b5"
# Remove when 8.3 is out
UPSTREAM_VERSION_UNKNOWN = "1"
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 12/16] systemd: Consider PACKAGECONFIG in RRECOMMENDS
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (10 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 11/16] vim: upgrade 9.0.0947 -> 9.0.1211 Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 13/16] toolchain-scripts: compatibility with unbound variable protection Steve Sakoman
` (3 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Niko Mauno <niko.mauno@vaisala.com>
Since RRECOMMENDS declaration implictly induces building the recipes
that provide the runtime recommended packages, conditionalize adding
such values according to associated PACKAGECONFIG settings in order
to avoid redundant building.
(From OE-Core rev: a1989add927f7805378fe4d5afbde780b747ba77)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/systemd/systemd_244.5.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/systemd/systemd_244.5.bb b/meta/recipes-core/systemd/systemd_244.5.bb
index 77ef2bc42f..2bca1fbc82 100644
--- a/meta/recipes-core/systemd/systemd_244.5.bb
+++ b/meta/recipes-core/systemd/systemd_244.5.bb
@@ -404,9 +404,9 @@ FILES_${PN}-binfmt = "${sysconfdir}/binfmt.d/ \
${rootlibexecdir}/systemd/systemd-binfmt \
${systemd_unitdir}/system/proc-sys-fs-binfmt_misc.* \
${systemd_unitdir}/system/systemd-binfmt.service"
-RRECOMMENDS_${PN}-binfmt = "kernel-module-binfmt-misc"
+RRECOMMENDS_${PN}-binfmt = "${@bb.utils.contains('PACKAGECONFIG', 'binfmt', 'kernel-module-binfmt-misc', '', d)}"
-RRECOMMENDS_${PN}-vconsole-setup = "kbd kbd-consolefonts kbd-keymaps"
+RRECOMMENDS_${PN}-vconsole-setup = "${@bb.utils.contains('PACKAGECONFIG', 'vconsole', 'kbd kbd-consolefonts kbd-keymaps', '', d)}"
FILES_${PN}-journal-gatewayd = "${rootlibexecdir}/systemd/systemd-journal-gatewayd \
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 13/16] toolchain-scripts: compatibility with unbound variable protection
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (11 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 12/16] systemd: Consider PACKAGECONFIG in RRECOMMENDS Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 14/16] lib/oe/reproducible: Use git log without gpg signature Steve Sakoman
` (2 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Jan Kircher <openembedded@hetsh.de>
Fixed an error when Bash's unbound variable protection is enabled (set -u) and variable "LD_LIBRARY_PATH" does not exist.
Signed-off-by: Jan Kircher <openembedded@hetsh.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 85685370b0ad93291cda59fb091a15eeecf5e0d5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/toolchain-scripts.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/toolchain-scripts.bbclass b/meta/classes/toolchain-scripts.bbclass
index db1d3215ef..9aa31dc6cd 100644
--- a/meta/classes/toolchain-scripts.bbclass
+++ b/meta/classes/toolchain-scripts.bbclass
@@ -29,7 +29,7 @@ toolchain_create_sdk_env_script () {
echo '# http://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html#AEN80' >> $script
echo '# http://xahlee.info/UnixResource_dir/_/ldpath.html' >> $script
echo '# Only disable this check if you are absolutely know what you are doing!' >> $script
- echo 'if [ ! -z "$LD_LIBRARY_PATH" ]; then' >> $script
+ echo 'if [ ! -z "${LD_LIBRARY_PATH:-}" ]; then' >> $script
echo " echo \"Your environment is misconfigured, you probably need to 'unset LD_LIBRARY_PATH'\"" >> $script
echo " echo \"but please check why this was set in the first place and that it's safe to unset.\"" >> $script
echo ' echo "The SDK will not operate correctly in most cases when LD_LIBRARY_PATH is set."' >> $script
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 14/16] lib/oe/reproducible: Use git log without gpg signature
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (12 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 13/16] toolchain-scripts: compatibility with unbound variable protection Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 15/16] selftest/virgl: use pkg-config from the host Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 16/16] python3: fix packaging of Windows distutils installer stubs Steve Sakoman
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Benoît Mauduit <bmauduit@beneth.fr>
Previously, if "showSignature" is present in user gitconfig, parsing
of the timestamp will fail.
Ideally we should replace this command with a git plumbing command.
Signed-off-by: Benoît Mauduit <bmauduit@beneth.fr>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 3bd6f78f79b3d3e87d8db1e11f58d8021f929843)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oe/reproducible.py | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/lib/oe/reproducible.py b/meta/lib/oe/reproducible.py
index 0938e4cb39..1ed79b18ca 100644
--- a/meta/lib/oe/reproducible.py
+++ b/meta/lib/oe/reproducible.py
@@ -62,7 +62,8 @@ def get_source_date_epoch_from_git(d, sourcedir):
return None
bb.debug(1, "git repository: %s" % gitpath)
- p = subprocess.run(['git', '--git-dir', gitpath, 'log', '-1', '--pretty=%ct'], check=True, stdout=subprocess.PIPE)
+ p = subprocess.run(['git', '-c', 'log.showSignature=false', '--git-dir', gitpath, 'log', '-1', '--pretty=%ct'],
+ check=True, stdout=subprocess.PIPE)
return int(p.stdout.decode('utf-8'))
def get_source_date_epoch_from_youngest_file(d, sourcedir):
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 15/16] selftest/virgl: use pkg-config from the host
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (13 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 14/16] lib/oe/reproducible: Use git log without gpg signature Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 16/16] python3: fix packaging of Windows distutils installer stubs Steve Sakoman
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
The check needs to report dri location on the host machine,
so pkg-config binary needs to be capable of finding the needed
dri.pc file on the host, and therefore needs to know where
host .pc files are located.
This may not be the case when using pkg-config from buildtools,
so this forces usage of host pkg-config.
runqemu already does the same PATH tweak, so this simply brings
the two in sync.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f0521f8a3ba7e15482756529ee7b0a95b3d53e7d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oeqa/selftest/cases/runtime_test.py b/meta/lib/oeqa/selftest/cases/runtime_test.py
index aeda01848a..5439bd426b 100644
--- a/meta/lib/oeqa/selftest/cases/runtime_test.py
+++ b/meta/lib/oeqa/selftest/cases/runtime_test.py
@@ -236,7 +236,7 @@ class TestImage(OESelftestTestCase):
except FileNotFoundError:
self.skipTest("/dev/dri directory does not exist; no render nodes available on this machine.")
try:
- dripath = subprocess.check_output("pkg-config --variable=dridriverdir dri", shell=True)
+ dripath = subprocess.check_output("PATH=/bin:/usr/bin:$PATH pkg-config --variable=dridriverdir dri", shell=True)
except subprocess.CalledProcessError as e:
self.skipTest("Could not determine the path to dri drivers on the host via pkg-config.\nPlease install Mesa development files (particularly, dri.pc) on the host machine.")
qemu_packageconfig = get_bb_var('PACKAGECONFIG', 'qemu-system-native')
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][dunfell 16/16] python3: fix packaging of Windows distutils installer stubs
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
` (14 preceding siblings ...)
2023-01-25 14:41 ` [OE-core][dunfell 15/16] selftest/virgl: use pkg-config from the host Steve Sakoman
@ 2023-01-25 14:41 ` Steve Sakoman
15 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-01-25 14:41 UTC (permalink / raw)
To: openembedded-core
The python3 Windows distutils installer stubs were split into a separate package
in poky commit dc1ab6482cfb30c714e7cbb421920943439a3fd6. This has regressed
during the upgrade to Python 3.8.2 in yocto-3.1
[YOCTO #13889]
https://bugzilla.yoctoproject.org/show_bug.cgi?id=13889
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/python/python3/python3-manifest.json | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/python/python3/python3-manifest.json b/meta/recipes-devtools/python/python3/python3-manifest.json
index 3bcc9b8662..0e87f91dd8 100644
--- a/meta/recipes-devtools/python/python3/python3-manifest.json
+++ b/meta/recipes-devtools/python/python3/python3-manifest.json
@@ -531,7 +531,9 @@
"rdepends": [
"core"
],
- "files": [],
+ "files": [
+ "${libdir}/python${PYTHON_MAJMIN}/distutils/command/wininst-*.exe"
+ ],
"cached": []
},
"distutils": {
--
2.25.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read
2023-01-25 14:41 ` [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read Steve Sakoman
@ 2023-01-31 7:18 ` Martin Jansa
[not found] ` <173F539A3738DDDD.25384@lists.openembedded.org>
1 sibling, 0 replies; 20+ messages in thread
From: Martin Jansa @ 2023-01-31 7:18 UTC (permalink / raw)
To: Steve Sakoman; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 8063 bytes --]
I haven't checked yet in dunfell, but in kirkstone this commit merged last
week breaks nativesdk-qemu builds.
This chunk:
+@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
pqxl, int group_id)
+ offset = le64_to_cpu(pqxl) & 0xffffffffffff;
+ return (void *)(intptr_t)offset;
+ case MEMSLOT_GROUP_GUEST:
+- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
+ return NULL;
+ }
+ ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
Uses size parameter which was added in previous commit (which wasn't
backported):
https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f
So either both commits need to be backported or this one reworked not to
use undeclared size as it leads to:
| ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt':
| ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first
use in this function); did you mean 'gsize'?
| 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
size)) {
| |
^~~~
| |
gsize
I'm surprised this wasn't caught on autobuilder already, maybe it's
triggered only with extra PACKAGECONFIG options we have enabled:
PACKAGECONFIG:append:class-nativesdk = " virglrenderer epoxy spice libusb
usb-redir"
Regards,
On Wed, Jan 25, 2023 at 3:42 PM Steve Sakoman <steve@sakoman.com> wrote:
> From: Hitendra Prajapati <hprajapati@mvista.com>
>
> Upstream-Status: Backport from
> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
>
> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> Signed-off-by: Steve Sakoman <steve@sakoman.com>
> ---
> meta/recipes-devtools/qemu/qemu.inc | 1 +
> .../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
> 2 files changed, 104 insertions(+)
> create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>
> diff --git a/meta/recipes-devtools/qemu/qemu.inc
> b/meta/recipes-devtools/qemu/qemu.inc
> index fff2c87780..898fa1a8d8 100644
> --- a/meta/recipes-devtools/qemu/qemu.inc
> +++ b/meta/recipes-devtools/qemu/qemu.inc
> @@ -115,6 +115,7 @@ SRC_URI = "
> https://download.qemu.org/${BPN}-${PV}.tar.xz \
> file://CVE-2021-3638.patch \
> file://CVE-2021-20196.patch \
> file://CVE-2021-3507.patch \
> + file://CVE-2022-4144.patch \
> "
> UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>
> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> new file mode 100644
> index 0000000000..3f0d5fbd5c
> --- /dev/null
> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> @@ -0,0 +1,103 @@
> +From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
> +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
> +Date: Mon, 28 Nov 2022 21:27:40 +0100
> +Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
> + (CVE-2022-4144)
> +MIME-Version: 1.0
> +Content-Type: text/plain; charset=UTF-8
> +Content-Transfer-Encoding: 8bit
> +
> +Have qxl_get_check_slot_offset() return false if the requested
> +buffer size does not fit within the slot memory region.
> +
> +Similarly qxl_phys2virt() now returns NULL in such case, and
> +qxl_dirty_one_surface() aborts.
> +
> +This avoids buffer overrun in the host pointer returned by
> +memory_region_get_ram_ptr().
> +
> +Fixes: CVE-2022-4144 (out-of-bounds read)
> +Reported-by: Wenxu Yin (@awxylitol)
> +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
> +
> +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> +Message-Id: <20221128202741.4945-5-philmd@linaro.org>
> +
> +Upstream-Status: Backport [
> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
> ]
> +CVE: CVE-2022-4144
> +Comments: Deleted patch hunk in qxl.h,as it contains change
> +in comments which is not present in current version of qemu.
> +
> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> +---
> + hw/display/qxl.c | 27 +++++++++++++++++++++++----
> + 1 file changed, 23 insertions(+), 4 deletions(-)
> +
> +diff --git a/hw/display/qxl.c b/hw/display/qxl.c
> +index cd7eb39d..6bc8385b 100644
> +--- a/hw/display/qxl.c
> ++++ b/hw/display/qxl.c
> +@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
> +
> + /* can be also called from spice server thread context */
> + static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl,
> +- uint32_t *s, uint64_t *o)
> ++ uint32_t *s, uint64_t *o,
> ++ size_t size_requested)
> + {
> + uint64_t phys = le64_to_cpu(pqxl);
> + uint32_t slot = (phys >> (64 - 8)) & 0xff;
> + uint64_t offset = phys & 0xffffffffffff;
> ++ uint64_t size_available;
> +
> + if (slot >= NUM_MEMSLOTS) {
> + qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
> +@@ -1468,6 +1470,23 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice
> *qxl, QXLPHYSICAL pqxl,
> + slot, offset, qxl->guest_slots[slot].size);
> + return false;
> + }
> ++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
> ++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
> ++ qxl_set_guest_bug(qxl,
> ++ "slot %d offset %"PRIu64" > region size
> %"PRIu64"\n",
> ++ slot, qxl->guest_slots[slot].offset + offset,
> ++ size_available);
> ++ return false;
> ++ }
> ++ size_available -= qxl->guest_slots[slot].offset + offset;
> ++ if (size_requested > size_available) {
> ++ qxl_set_guest_bug(qxl,
> ++ "slot %d offset %"PRIu64" size %zu: "
> ++ "overrun by %"PRIu64" bytes\n",
> ++ slot, offset, size_requested,
> ++ size_requested - size_available);
> ++ return false;
> ++ }
> +
> + *s = slot;
> + *o = offset;
> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl, int group_id)
> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
> + return (void *)(intptr_t)offset;
> + case MEMSLOT_GROUP_GUEST:
> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size))
> {
> + return NULL;
> + }
> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
> +@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice
> *qxl, QXLPHYSICAL pqxl,
> + uint32_t slot;
> + bool rc;
> +
> +- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
> +- assert(rc == true);
> + size = (uint64_t)height * abs(stride);
> ++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
> ++ assert(rc == true);
> + trace_qxl_surfaces_dirty(qxl->id, offset, size);
> + qxl_set_dirty(qxl->guest_slots[slot].mr,
> + qxl->guest_slots[slot].offset + offset,
> +--
> +2.25.1
> +
> --
> 2.25.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#176358):
> https://lists.openembedded.org/g/openembedded-core/message/176358
> Mute This Topic: https://lists.openembedded.org/mt/96521255/3617156
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> Martin.Jansa@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
[-- Attachment #2: Type: text/html, Size: 11223 bytes --]
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read
[not found] ` <173F539A3738DDDD.25384@lists.openembedded.org>
@ 2023-01-31 7:39 ` Martin Jansa
2023-02-03 15:59 ` Steve Sakoman
0 siblings, 1 reply; 20+ messages in thread
From: Martin Jansa @ 2023-01-31 7:39 UTC (permalink / raw)
To: Martin.Jansa, bhabu.bindu, Hitendra Prajapati
Cc: Steve Sakoman, openembedded-core
[-- Attachment #1: Type: text/plain, Size: 9101 bytes --]
On Tue, Jan 31, 2023 at 8:18 AM Martin Jansa via lists.openembedded.org
<Martin.Jansa=gmail.com@lists.openembedded.org> wrote:
> I haven't checked yet in dunfell, but in kirkstone this commit merged last
> week breaks nativesdk-qemu builds.
>
I can confirm it fails the same with this commit from Hitendra in dunfell:
nativesdk-qemu/4.2.0-r0/qemu-4.2.0/hw/display/qxl.c:1508:67: error: 'size'
undeclared (first use in this function); did you mean 'gsize'?
| 1508 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
size)) {
| |
^~~~
| |
gsize
as well as the same backport from Bhabu in kirkstone (already merged):
https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4cb3874abf4fdeb04337a48a14c765ba9b2269d4
To reproduce this just enable "spice" PACKAGECONFIG in nativesdk-qemu.
Hitendra, Bhabu: please have a look.
Regards,
>
> This chunk:
> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl, int group_id)
> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
> + return (void *)(intptr_t)offset;
> + case MEMSLOT_GROUP_GUEST:
> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size))
> {
> + return NULL;
> + }
> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
>
> Uses size parameter which was added in previous commit (which wasn't
> backported):
>
> https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f
>
> So either both commits need to be backported or this one reworked not to
> use undeclared size as it leads to:
>
> | ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt':
> | ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first
> use in this function); did you mean 'gsize'?
> | 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot,
> &offset, size)) {
> | |
> ^~~~
> | |
> gsize
>
> I'm surprised this wasn't caught on autobuilder already, maybe it's
> triggered only with extra PACKAGECONFIG options we have enabled:
> PACKAGECONFIG:append:class-nativesdk = " virglrenderer epoxy spice libusb
> usb-redir"
>
> Regards,
>
>
> On Wed, Jan 25, 2023 at 3:42 PM Steve Sakoman <steve@sakoman.com> wrote:
>
>> From: Hitendra Prajapati <hprajapati@mvista.com>
>>
>> Upstream-Status: Backport from
>> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
>>
>> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>> Signed-off-by: Steve Sakoman <steve@sakoman.com>
>> ---
>> meta/recipes-devtools/qemu/qemu.inc | 1 +
>> .../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
>> 2 files changed, 104 insertions(+)
>> create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>>
>> diff --git a/meta/recipes-devtools/qemu/qemu.inc
>> b/meta/recipes-devtools/qemu/qemu.inc
>> index fff2c87780..898fa1a8d8 100644
>> --- a/meta/recipes-devtools/qemu/qemu.inc
>> +++ b/meta/recipes-devtools/qemu/qemu.inc
>> @@ -115,6 +115,7 @@ SRC_URI = "
>> https://download.qemu.org/${BPN}-${PV}.tar.xz \
>> file://CVE-2021-3638.patch \
>> file://CVE-2021-20196.patch \
>> file://CVE-2021-3507.patch \
>> + file://CVE-2022-4144.patch \
>> "
>> UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>>
>> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>> b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>> new file mode 100644
>> index 0000000000..3f0d5fbd5c
>> --- /dev/null
>> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>> @@ -0,0 +1,103 @@
>> +From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
>> +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
>> +Date: Mon, 28 Nov 2022 21:27:40 +0100
>> +Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
>> + (CVE-2022-4144)
>> +MIME-Version: 1.0
>> +Content-Type: text/plain; charset=UTF-8
>> +Content-Transfer-Encoding: 8bit
>> +
>> +Have qxl_get_check_slot_offset() return false if the requested
>> +buffer size does not fit within the slot memory region.
>> +
>> +Similarly qxl_phys2virt() now returns NULL in such case, and
>> +qxl_dirty_one_surface() aborts.
>> +
>> +This avoids buffer overrun in the host pointer returned by
>> +memory_region_get_ram_ptr().
>> +
>> +Fixes: CVE-2022-4144 (out-of-bounds read)
>> +Reported-by: Wenxu Yin (@awxylitol)
>> +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
>> +
>> +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
>> +Message-Id: <20221128202741.4945-5-philmd@linaro.org>
>> +
>> +Upstream-Status: Backport [
>> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
>> ]
>> +CVE: CVE-2022-4144
>> +Comments: Deleted patch hunk in qxl.h,as it contains change
>> +in comments which is not present in current version of qemu.
>> +
>> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>> +---
>> + hw/display/qxl.c | 27 +++++++++++++++++++++++----
>> + 1 file changed, 23 insertions(+), 4 deletions(-)
>> +
>> +diff --git a/hw/display/qxl.c b/hw/display/qxl.c
>> +index cd7eb39d..6bc8385b 100644
>> +--- a/hw/display/qxl.c
>> ++++ b/hw/display/qxl.c
>> +@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
>> +
>> + /* can be also called from spice server thread context */
>> + static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL
>> pqxl,
>> +- uint32_t *s, uint64_t *o)
>> ++ uint32_t *s, uint64_t *o,
>> ++ size_t size_requested)
>> + {
>> + uint64_t phys = le64_to_cpu(pqxl);
>> + uint32_t slot = (phys >> (64 - 8)) & 0xff;
>> + uint64_t offset = phys & 0xffffffffffff;
>> ++ uint64_t size_available;
>> +
>> + if (slot >= NUM_MEMSLOTS) {
>> + qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
>> +@@ -1468,6 +1470,23 @@ static bool
>> qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
>> + slot, offset, qxl->guest_slots[slot].size);
>> + return false;
>> + }
>> ++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
>> ++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
>> ++ qxl_set_guest_bug(qxl,
>> ++ "slot %d offset %"PRIu64" > region size
>> %"PRIu64"\n",
>> ++ slot, qxl->guest_slots[slot].offset + offset,
>> ++ size_available);
>> ++ return false;
>> ++ }
>> ++ size_available -= qxl->guest_slots[slot].offset + offset;
>> ++ if (size_requested > size_available) {
>> ++ qxl_set_guest_bug(qxl,
>> ++ "slot %d offset %"PRIu64" size %zu: "
>> ++ "overrun by %"PRIu64" bytes\n",
>> ++ slot, offset, size_requested,
>> ++ size_requested - size_available);
>> ++ return false;
>> ++ }
>> +
>> + *s = slot;
>> + *o = offset;
>> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
>> pqxl, int group_id)
>> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
>> + return (void *)(intptr_t)offset;
>> + case MEMSLOT_GROUP_GUEST:
>> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
>> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
>> size)) {
>> + return NULL;
>> + }
>> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
>> +@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice
>> *qxl, QXLPHYSICAL pqxl,
>> + uint32_t slot;
>> + bool rc;
>> +
>> +- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
>> +- assert(rc == true);
>> + size = (uint64_t)height * abs(stride);
>> ++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
>> ++ assert(rc == true);
>> + trace_qxl_surfaces_dirty(qxl->id, offset, size);
>> + qxl_set_dirty(qxl->guest_slots[slot].mr,
>> + qxl->guest_slots[slot].offset + offset,
>> +--
>> +2.25.1
>> +
>> --
>> 2.25.1
>>
>>
>>
>>
>>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#176506):
> https://lists.openembedded.org/g/openembedded-core/message/176506
> Mute This Topic: https://lists.openembedded.org/mt/96521255/3617156
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> Martin.Jansa@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
[-- Attachment #2: Type: text/html, Size: 13491 bytes --]
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read
2023-01-31 7:39 ` Martin Jansa
@ 2023-02-03 15:59 ` Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-02-03 15:59 UTC (permalink / raw)
To: Martin Jansa; +Cc: bhabu.bindu, Hitendra Prajapati, openembedded-core
On Mon, Jan 30, 2023 at 9:39 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
>
> On Tue, Jan 31, 2023 at 8:18 AM Martin Jansa via lists.openembedded.org <Martin.Jansa=gmail.com@lists.openembedded.org> wrote:
>>
>> I haven't checked yet in dunfell, but in kirkstone this commit merged last week breaks nativesdk-qemu builds.
>
>
> I can confirm it fails the same with this commit from Hitendra in dunfell:
>
> nativesdk-qemu/4.2.0-r0/qemu-4.2.0/hw/display/qxl.c:1508:67: error: 'size' undeclared (first use in this function); did you mean 'gsize'?
> | 1508 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
> | | ^~~~
> | | gsize
>
> as well as the same backport from Bhabu in kirkstone (already merged):
> https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4cb3874abf4fdeb04337a48a14c765ba9b2269d4
>
> To reproduce this just enable "spice" PACKAGECONFIG in nativesdk-qemu.
>
> Hitendra, Bhabu: please have a look.
Yes, please do! Unless I get a fix for the spice regression sometime
soon I will revert the patch in kirkstone and of course won't take the
dunfell version.
Steve
>> This chunk:
>> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
>> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
>> + return (void *)(intptr_t)offset;
>> + case MEMSLOT_GROUP_GUEST:
>> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
>> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
>> + return NULL;
>> + }
>> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
>>
>> Uses size parameter which was added in previous commit (which wasn't backported):
>> https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f
>>
>> So either both commits need to be backported or this one reworked not to use undeclared size as it leads to:
>>
>> | ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt':
>> | ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first use in this function); did you mean 'gsize'?
>> | 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
>> | | ^~~~
>> | | gsize
>>
>> I'm surprised this wasn't caught on autobuilder already, maybe it's triggered only with extra PACKAGECONFIG options we have enabled:
>> PACKAGECONFIG:append:class-nativesdk = " virglrenderer epoxy spice libusb usb-redir"
>>
>> Regards,
>>
>>
>> On Wed, Jan 25, 2023 at 3:42 PM Steve Sakoman <steve@sakoman.com> wrote:
>>>
>>> From: Hitendra Prajapati <hprajapati@mvista.com>
>>>
>>> Upstream-Status: Backport from https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
>>>
>>> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>>> Signed-off-by: Steve Sakoman <steve@sakoman.com>
>>> ---
>>> meta/recipes-devtools/qemu/qemu.inc | 1 +
>>> .../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
>>> 2 files changed, 104 insertions(+)
>>> create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>>>
>>> diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
>>> index fff2c87780..898fa1a8d8 100644
>>> --- a/meta/recipes-devtools/qemu/qemu.inc
>>> +++ b/meta/recipes-devtools/qemu/qemu.inc
>>> @@ -115,6 +115,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
>>> file://CVE-2021-3638.patch \
>>> file://CVE-2021-20196.patch \
>>> file://CVE-2021-3507.patch \
>>> + file://CVE-2022-4144.patch \
>>> "
>>> UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>>>
>>> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>>> new file mode 100644
>>> index 0000000000..3f0d5fbd5c
>>> --- /dev/null
>>> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>>> @@ -0,0 +1,103 @@
>>> +From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
>>> +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
>>> +Date: Mon, 28 Nov 2022 21:27:40 +0100
>>> +Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
>>> + (CVE-2022-4144)
>>> +MIME-Version: 1.0
>>> +Content-Type: text/plain; charset=UTF-8
>>> +Content-Transfer-Encoding: 8bit
>>> +
>>> +Have qxl_get_check_slot_offset() return false if the requested
>>> +buffer size does not fit within the slot memory region.
>>> +
>>> +Similarly qxl_phys2virt() now returns NULL in such case, and
>>> +qxl_dirty_one_surface() aborts.
>>> +
>>> +This avoids buffer overrun in the host pointer returned by
>>> +memory_region_get_ram_ptr().
>>> +
>>> +Fixes: CVE-2022-4144 (out-of-bounds read)
>>> +Reported-by: Wenxu Yin (@awxylitol)
>>> +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
>>> +
>>> +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
>>> +Message-Id: <20221128202741.4945-5-philmd@linaro.org>
>>> +
>>> +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622]
>>> +CVE: CVE-2022-4144
>>> +Comments: Deleted patch hunk in qxl.h,as it contains change
>>> +in comments which is not present in current version of qemu.
>>> +
>>> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>>> +---
>>> + hw/display/qxl.c | 27 +++++++++++++++++++++++----
>>> + 1 file changed, 23 insertions(+), 4 deletions(-)
>>> +
>>> +diff --git a/hw/display/qxl.c b/hw/display/qxl.c
>>> +index cd7eb39d..6bc8385b 100644
>>> +--- a/hw/display/qxl.c
>>> ++++ b/hw/display/qxl.c
>>> +@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
>>> +
>>> + /* can be also called from spice server thread context */
>>> + static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
>>> +- uint32_t *s, uint64_t *o)
>>> ++ uint32_t *s, uint64_t *o,
>>> ++ size_t size_requested)
>>> + {
>>> + uint64_t phys = le64_to_cpu(pqxl);
>>> + uint32_t slot = (phys >> (64 - 8)) & 0xff;
>>> + uint64_t offset = phys & 0xffffffffffff;
>>> ++ uint64_t size_available;
>>> +
>>> + if (slot >= NUM_MEMSLOTS) {
>>> + qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
>>> +@@ -1468,6 +1470,23 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
>>> + slot, offset, qxl->guest_slots[slot].size);
>>> + return false;
>>> + }
>>> ++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
>>> ++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
>>> ++ qxl_set_guest_bug(qxl,
>>> ++ "slot %d offset %"PRIu64" > region size %"PRIu64"\n",
>>> ++ slot, qxl->guest_slots[slot].offset + offset,
>>> ++ size_available);
>>> ++ return false;
>>> ++ }
>>> ++ size_available -= qxl->guest_slots[slot].offset + offset;
>>> ++ if (size_requested > size_available) {
>>> ++ qxl_set_guest_bug(qxl,
>>> ++ "slot %d offset %"PRIu64" size %zu: "
>>> ++ "overrun by %"PRIu64" bytes\n",
>>> ++ slot, offset, size_requested,
>>> ++ size_requested - size_available);
>>> ++ return false;
>>> ++ }
>>> +
>>> + *s = slot;
>>> + *o = offset;
>>> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
>>> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
>>> + return (void *)(intptr_t)offset;
>>> + case MEMSLOT_GROUP_GUEST:
>>> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
>>> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
>>> + return NULL;
>>> + }
>>> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
>>> +@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
>>> + uint32_t slot;
>>> + bool rc;
>>> +
>>> +- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
>>> +- assert(rc == true);
>>> + size = (uint64_t)height * abs(stride);
>>> ++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
>>> ++ assert(rc == true);
>>> + trace_qxl_surfaces_dirty(qxl->id, offset, size);
>>> + qxl_set_dirty(qxl->guest_slots[slot].mr,
>>> + qxl->guest_slots[slot].offset + offset,
>>> +--
>>> +2.25.1
>>> +
>>> --
>>> 2.25.1
>>>
>>>
>>>
>>>
>>
>>
>>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#176508): https://lists.openembedded.org/g/openembedded-core/message/176508
> Mute This Topic: https://lists.openembedded.org/mt/96521255/3617601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [sakoman@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2023-02-03 15:59 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-25 14:41 [OE-core][dunfell 00/16] Patch review Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 01/16] cve-update-db-native: Allow to overrule the URL in a bbappend Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 02/16] cve-update-db-native: add more logging when fetching Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 03/16] cve-update-db-native: avoid incomplete updates Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 04/16] cve-update-db-native: show IP on failure Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 05/16] cve-check: write the cve manifest to IMGDEPLOYDIR Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 06/16] cairo: fix CVE patches assigned wrong CVE number Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read Steve Sakoman
2023-01-31 7:18 ` Martin Jansa
[not found] ` <173F539A3738DDDD.25384@lists.openembedded.org>
2023-01-31 7:39 ` Martin Jansa
2023-02-03 15:59 ` Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 08/16] ffmpeg: Fix CVE-2022-3109 Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 09/16] xserver-xorg: Fix Multiple CVEs Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 10/16] linux-firmware: upgrade 20221109 -> 20221214 Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 11/16] vim: upgrade 9.0.0947 -> 9.0.1211 Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 12/16] systemd: Consider PACKAGECONFIG in RRECOMMENDS Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 13/16] toolchain-scripts: compatibility with unbound variable protection Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 14/16] lib/oe/reproducible: Use git log without gpg signature Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 15/16] selftest/virgl: use pkg-config from the host Steve Sakoman
2023-01-25 14:41 ` [OE-core][dunfell 16/16] python3: fix packaging of Windows distutils installer stubs Steve Sakoman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.