forked from openembedded/meta-openembedded
-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Can Wong <[email protected]>
- Loading branch information
Showing
14 changed files
with
177 additions
and
9 deletions.
There are no files selected for viewing
68 changes: 68 additions & 0 deletions
68
meta-networking/recipes-extended/tgt/files/CVE-2024-45751.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| From abd8e0d987ab56013d360077202bf2aca20a42dd Mon Sep 17 00:00:00 2001 | ||
| From: Richard Weinberger <[email protected]> | ||
| Date: Tue, 3 Sep 2024 16:14:58 +0200 | ||
| Subject: [PATCH] chap: Use proper entropy source | ||
|
|
||
| The challenge sent to the initiator is based on a poor | ||
| source of randomness, it uses rand() without seeding it by srand(). | ||
| So the glibc PRNG is always seeded with 1 and as a consequence the | ||
| sequence of challenges is always the same. | ||
|
|
||
| An attacker which is able to monitor network traffic can apply a replay | ||
| attack to bypass the CHAP authentication. All the attacker has to do | ||
| is waiting for the server or the service to restart and replay with a | ||
| previously record CHAP session which fits into the sequence. | ||
|
|
||
| To overcome the issue, use getrandom() to query the kernel random | ||
| number generator. | ||
| Also always send a challenge of length CHAP_CHALLENGE_MAX, there is no | ||
| benefit in sending a variable length challenge. | ||
|
|
||
| Signed-off-by: Richard Weinberger <[email protected]> | ||
|
|
||
| Upstream-Status: Backport [https://github.com/fujita/tgt/commit/abd8e0d987ab56013d360077202bf2aca20a42dd] | ||
| CVE: CVE-2024-45751 | ||
| Signed-off-by: Vijay Anusuri <[email protected]> | ||
| --- | ||
| usr/iscsi/chap.c | 12 +++++------- | ||
| 1 file changed, 5 insertions(+), 7 deletions(-) | ||
|
|
||
| diff --git a/usr/iscsi/chap.c b/usr/iscsi/chap.c | ||
| index aa0fc671..b89ecabd 100644 | ||
| --- a/usr/iscsi/chap.c | ||
| +++ b/usr/iscsi/chap.c | ||
| @@ -28,6 +28,7 @@ | ||
| #include <stdio.h> | ||
| #include <stdlib.h> | ||
| #include <string.h> | ||
| +#include <sys/random.h> | ||
|
|
||
| #include "iscsid.h" | ||
| #include "tgtd.h" | ||
| @@ -359,22 +360,19 @@ static int chap_initiator_auth_create_challenge(struct iscsi_connection *conn) | ||
| sprintf(text, "%u", (unsigned char)conn->auth.chap.id); | ||
| text_key_add(conn, "CHAP_I", text); | ||
|
|
||
| - /* | ||
| - * FIXME: does a random challenge length provide any benefits security- | ||
| - * wise, or should we rather always use the max. allowed length of | ||
| - * 1024 for the (unencoded) challenge? | ||
| - */ | ||
| - conn->auth.chap.challenge_size = (rand() % (CHAP_CHALLENGE_MAX / 2)) + CHAP_CHALLENGE_MAX / 2; | ||
| + conn->auth.chap.challenge_size = CHAP_CHALLENGE_MAX; | ||
|
|
||
| conn->auth.chap.challenge = malloc(conn->auth.chap.challenge_size); | ||
| if (!conn->auth.chap.challenge) | ||
| return CHAP_TARGET_ERROR; | ||
|
|
||
| + if (getrandom(conn->auth.chap.challenge, conn->auth.chap.challenge_size, 0) != conn->auth.chap.challenge_size) | ||
| + return CHAP_TARGET_ERROR; | ||
| + | ||
| p = text; | ||
| strcpy(p, "0x"); | ||
| p += 2; | ||
| for (i = 0; i < conn->auth.chap.challenge_size; i++) { | ||
| - conn->auth.chap.challenge[i] = rand(); | ||
| sprintf(p, "%.2hhx", conn->auth.chap.challenge[i]); | ||
| p += 2; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
meta-networking/recipes-protocols/frr/frr/CVE-2024-44070.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| From 0998b38e4d61179441f90dd7e7fd6a3a8b7bd8c5 Mon Sep 17 00:00:00 2001 | ||
| From: Donatas Abraitis <[email protected]> | ||
| Date: Wed, 31 Jul 2024 05:56:14 +0000 | ||
| Subject: [PATCH] bgpd: Check the actual remaining stream length before taking | ||
| TLV value ``` | ||
|
|
||
| 0 0xb50b9f898028 in __sanitizer_print_stack_trace (/home/ | ||
| ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/ | ||
| bgpd+0x368028) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) | ||
| 1 0xb50b9f7ed8e4 in fuzzer::PrintStackTrace() (/home/ubuntu/ | ||
| frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x2bd8e4) | ||
| (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) | ||
| 2 0xb50b9f7d4d9c in fuzzer::Fuzzer::CrashCallback() (/home/ | ||
| ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/ | ||
| bgpd+0x2a4d9c) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) | ||
| 3 0xe0d12d7469cc (linux-vdso.so.1+0x9cc) (BuildId: | ||
| 1a77697e9d723fe22246cfd7641b140c427b7e11) | ||
| 4 0xe0d12c88f1fc in __pthread_kill_implementation nptl/ | ||
| pthread_kill.c:43:17 | ||
| 5 0xe0d12c84a678 in gsignal signal/../sysdeps/posix/raise.c:26:13 | ||
| 6 0xe0d12c83712c in abort stdlib/abort.c:79:7 | ||
| 7 0xe0d12d214724 in _zlog_assert_failed /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/lib/zlog.c:789:2 | ||
| 8 0xe0d12d1285e4 in stream_get /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/lib/stream.c:324:3 | ||
| 9 0xb50b9f8e47c4 in bgp_attr_encap /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/bgpd/bgp_attr.c:2758:3 | ||
| 10 0xb50b9f8dcd38 in bgp_attr_parse /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/bgpd/bgp_attr.c:3783:10 | ||
| 11 0xb50b9faf74b4 in bgp_update_receive /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/bgpd/bgp_packet.c:2383:20 | ||
| 12 0xb50b9faf1dcc in bgp_process_packet /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/bgpd/bgp_packet.c:4075:11 | ||
| 13 0xb50b9f8c90d0 in LLVMFuzzerTestOneInput /home/ubuntu/frr-public/ | ||
| frr_public_private-libfuzzer/bgpd/bgp_main.c:582:3 | ||
| ``` | ||
|
|
||
| Reported-by: Iggy Frankovic <[email protected]> | ||
| Signed-off-by: Donatas Abraitis <[email protected]> | ||
|
|
||
| CVE: CVE-2024-44070 | ||
| Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/0998b38e4d61179441f90dd7e7fd6a3a8b7bd8c5] | ||
|
|
||
| Signed-off-by: Yogita Urade <[email protected]> | ||
| --- | ||
| bgpd/bgp_attr.c | 8 ++++++++ | ||
| 1 file changed, 8 insertions(+) | ||
|
|
||
| diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c | ||
| index 1e08a218e..ef45d5c46 100644 | ||
| --- a/bgpd/bgp_attr.c | ||
| +++ b/bgpd/bgp_attr.c | ||
| @@ -2475,6 +2475,14 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args) | ||
| args->total); | ||
| } | ||
|
|
||
| + if (STREAM_READABLE(BGP_INPUT(peer)) < sublength) { | ||
| + zlog_err("Tunnel Encap attribute sub-tlv length %d exceeds remaining stream length %zu", | ||
| + sublength, STREAM_READABLE(BGP_INPUT(peer))); | ||
| + return bgp_attr_malformed(args, | ||
| + BGP_NOTIFY_UPDATE_OPT_ATTR_ERR, | ||
| + args->total); | ||
| + } | ||
| + | ||
| /* alloc and copy sub-tlv */ | ||
| /* TBD make sure these are freed when attributes are released */ | ||
| tlv = XCALLOC(MTYPE_ENCAP_TLV, | ||
| -- | ||
| 2.40.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| #!/bin/sh | ||
| ptestdir=$(dirname "$(readlink -f "$0")") | ||
| cd "$ptestdir"/tests || exit | ||
|
|
||
| for test in *_test; do | ||
| if ./${test} >/dev/null 2>&1; then | ||
| echo "PASS: ${test}" | ||
| else | ||
| echo "FAIL: ${test}" | ||
| fi | ||
| done | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
meta-oe/recipes-devtools/android-tools/android-tools/android-tools-adbd.service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters