From patchwork Fri Sep 26 16:23:20 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Khem Raj X-Patchwork-Id: 38010 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ee0-f72.google.com (mail-ee0-f72.google.com [74.125.83.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 4A9BA20F2E for ; Fri, 26 Sep 2014 16:19:55 +0000 (UTC) Received: by mail-ee0-f72.google.com with SMTP id c13sf6263068eek.7 for ; Fri, 26 Sep 2014 09:19:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:delivered-to:from:to:date :message-id:cc:subject:precedence:list-id:list-unsubscribe :list-archive:list-post:list-help:list-subscribe:mime-version:sender :errors-to:x-original-sender:x-original-authentication-results :mailing-list:content-type:content-transfer-encoding; bh=IRf8bX7Ibu2RL4XmT1lIGU2J7SZ/jw6pxORV/4msFNk=; b=TIuIvF+iBk0dW6yEwuv/VYFCiAhjiOMKBfOv9JXMo2nPknig3yenzm7+7jwBGnP73d KqRrR/GEgPXaes0C6POQXMSWpcExUfZNTkjYinEN8oqDE3bmk2C9avWclo4sb2adoPpI SkBHJYw4+3Ch9lXRFb9aPPiDNn7JorBootnfsxp/WSXgYVxg0/d4tsMLEs6nYNFFV3ZC FcAVH20uAYN8hHUfu7SVSDWB9hLoWk/QZNixt3MgNhfCEpj/caicKgGT7WfFztzkqP8L IkiONBeT21LsN1Wn+Z1NYIh6IEZ0wnjDrtZS/5/Ixz6uxewKR0HOeEqIj7U3OcEhJM6m ZCcg== X-Gm-Message-State: ALoCoQkdf1JinspvhNCuPX9bBQ2lC+GmU2QsZDQwYw/vqlK5qjU1gk6LfqMm+w2Cv75W7aOnRDRR X-Received: by 10.112.146.2 with SMTP id sy2mr576115lbb.14.1411748394370; Fri, 26 Sep 2014 09:19:54 -0700 (PDT) X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.27.2 with SMTP id p2ls412714lag.10.gmail; Fri, 26 Sep 2014 09:19:54 -0700 (PDT) X-Received: by 10.112.130.41 with SMTP id ob9mr20140121lbb.12.1411748394144; Fri, 26 Sep 2014 09:19:54 -0700 (PDT) Received: from mail-lb0-x229.google.com (mail-lb0-x229.google.com [2a00:1450:4010:c04::229]) by mx.google.com with ESMTPS id iq2si6751424lac.77.2014.09.26.09.19.53 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 26 Sep 2014 09:19:53 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 2a00:1450:4010:c04::229 as permitted sender) client-ip=2a00:1450:4010:c04::229; Received: by mail-lb0-f169.google.com with SMTP id u10so1379307lbd.14 for ; Fri, 26 Sep 2014 09:19:53 -0700 (PDT) X-Received: by 10.112.62.200 with SMTP id a8mr20135775lbs.34.1411748393920; Fri, 26 Sep 2014 09:19:53 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.130.169 with SMTP id of9csp89322lbb; Fri, 26 Sep 2014 09:19:53 -0700 (PDT) X-Received: by 10.68.224.70 with SMTP id ra6mr33116098pbc.33.1411748392270; Fri, 26 Sep 2014 09:19:52 -0700 (PDT) Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id qj8si10003950pac.189.2014.09.26.09.19.51 for ; Fri, 26 Sep 2014 09:19:52 -0700 (PDT) Received-SPF: none (google.com: openembedded-core-bounces@lists.openembedded.org does not designate permitted sender hosts) client-ip=140.211.169.62; Received: from mail.openembedded.org (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id ECC4765D59; Fri, 26 Sep 2014 16:19:35 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-pd0-f178.google.com (mail-pd0-f178.google.com [209.85.192.178]) by mail.openembedded.org (Postfix) with ESMTP id 9A42460167 for ; Fri, 26 Sep 2014 16:19:23 +0000 (UTC) Received: by mail-pd0-f178.google.com with SMTP id ft15so13125511pdb.9 for ; Fri, 26 Sep 2014 09:19:22 -0700 (PDT) X-Received: by 10.70.92.109 with SMTP id cl13mr38910099pdb.1.1411748362496; Fri, 26 Sep 2014 09:19:22 -0700 (PDT) Received: from haswell.localdomain (c-76-103-58-225.hsd1.ca.comcast.net. [76.103.58.225]) by mx.google.com with ESMTPSA id ny7sm5368228pab.38.2014.09.26.09.19.21 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 26 Sep 2014 09:19:21 -0700 (PDT) From: Khem Raj To: openembedded-core@lists.openembedded.org Date: Fri, 26 Sep 2014 09:23:20 -0700 Message-Id: <1411748600-10055-1-git-send-email-raj.khem@gmail.com> X-Mailer: git-send-email 2.1.0 Cc: Khem Raj Subject: [OE-core] [PATCH] bash: Fix shellshock vulnerability X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org X-Original-Sender: raj.khem@gmail.com X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 2a00:1450:4010:c04::229 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org; dkim=neutral (body hash did not verify) header.i=@; dmarc=fail (p=NONE dis=NONE) header.from=gmail.com Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 From: Khem Raj CVE-2014-6271 Change-Id: Ia6a9f7dab108f0ba40c84eef2d8a61dc2303f3f3 Signed-off-by: Khem Raj --- .../bash/bash-3.2.48/shellshock.patch | 84 +++++++++++++++++ meta/recipes-extended/bash/bash/shellshock.patch | 101 +++++++++++++++++++++ meta/recipes-extended/bash/bash_3.2.48.bb | 1 + meta/recipes-extended/bash/bash_4.3.bb | 1 + 4 files changed, 187 insertions(+) create mode 100644 meta/recipes-extended/bash/bash-3.2.48/shellshock.patch create mode 100644 meta/recipes-extended/bash/bash/shellshock.patch diff --git a/meta/recipes-extended/bash/bash-3.2.48/shellshock.patch b/meta/recipes-extended/bash/bash-3.2.48/shellshock.patch new file mode 100644 index 0000000..bed9cee --- /dev/null +++ b/meta/recipes-extended/bash/bash-3.2.48/shellshock.patch @@ -0,0 +1,84 @@ +Fix CVE-2014-6271 + +specially-crafted environment variables can be used to inject shell commands +taken from +https://bugzilla.redhat.com/show_bug.cgi?id=1141597 + +Upstream-Status: Submitted + +Signed-off-by: Khem Raj + +Index: bash-3.2.48/variables.c +=================================================================== +--- bash-3.2.48.orig/variables.c 2008-11-18 05:14:57.000000000 -0800 ++++ bash-3.2.48/variables.c 2014-09-26 09:12:58.700080056 -0700 +@@ -318,12 +318,10 @@ + temp_string[char_index] = ' '; + strcpy (temp_string + char_index + 1, string); + +- parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST); +- +- /* Ancient backwards compatibility. Old versions of bash exported +- functions like name()=() {...} */ +- if (name[char_index - 1] == ')' && name[char_index - 2] == '(') +- name[char_index - 2] = '\0'; ++ /* Don't import function names that are invalid identifiers from the ++ environment. */ ++ if (legal_identifier (name)) ++ parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); + + if (temp_var = find_function (name)) + { +@@ -332,10 +330,6 @@ + } + else + report_error (_("error importing function definition for `%s'"), name); +- +- /* ( */ +- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0') +- name[char_index - 2] = '('; /* ) */ + } + #if defined (ARRAY_VARS) + # if 0 +Index: bash-3.2.48/builtins/common.h +=================================================================== +--- bash-3.2.48.orig/builtins/common.h 2006-03-06 06:38:44.000000000 -0800 ++++ bash-3.2.48/builtins/common.h 2014-09-26 09:12:58.700080056 -0700 +@@ -33,6 +33,8 @@ + #define SEVAL_RESETLINE 0x010 + + /* Flags for describe_command, shared between type.def and command.def */ ++#define SEVAL_FUNCDEF 0x080 /* only allow function definitions */ ++#define SEVAL_ONECMD 0x100 /* only allow a single command */ + #define CDESC_ALL 0x001 /* type -a */ + #define CDESC_SHORTDESC 0x002 /* command -V */ + #define CDESC_REUSABLE 0x004 /* command -v */ +Index: bash-3.2.48/builtins/evalstring.c +=================================================================== +--- bash-3.2.48.orig/builtins/evalstring.c 2008-11-18 05:15:12.000000000 -0800 ++++ bash-3.2.48/builtins/evalstring.c 2014-09-26 09:12:58.700080056 -0700 +@@ -234,6 +234,14 @@ + { + struct fd_bitmap *bitmap; + ++ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) ++ { ++ internal_warning ("%s: ignoring function definition attempt", from_file); ++ should_jump_to_top_level = 0; ++ last_result = last_command_exit_value = EX_BADUSAGE; ++ break; ++ } ++ + bitmap = new_fd_bitmap (FD_BITMAP_SIZE); + begin_unwind_frame ("pe_dispose"); + add_unwind_protect (dispose_fd_bitmap, bitmap); +@@ -291,6 +299,9 @@ + dispose_command (command); + dispose_fd_bitmap (bitmap); + discard_unwind_frame ("pe_dispose"); ++ ++ if (flags & SEVAL_ONECMD) ++ break; + } + } + else diff --git a/meta/recipes-extended/bash/bash/shellshock.patch b/meta/recipes-extended/bash/bash/shellshock.patch new file mode 100644 index 0000000..912e6ff --- /dev/null +++ b/meta/recipes-extended/bash/bash/shellshock.patch @@ -0,0 +1,101 @@ +Fix CVE-2014-6271 + +specially-crafted environment variables can be used to inject shell commands +taken from +https://bugzilla.redhat.com/show_bug.cgi?id=1141597 + +Upstream-Status: Submitted + +Signed-off-by: Khem Raj + +Index: bash-4.3/variables.c +=================================================================== +--- bash-4.3.orig/variables.c 2014-02-14 08:55:12.000000000 -0800 ++++ bash-4.3/variables.c 2014-09-26 08:40:24.704080056 -0700 +@@ -358,13 +358,11 @@ + temp_string[char_index] = ' '; + strcpy (temp_string + char_index + 1, string); + +- if (posixly_correct == 0 || legal_identifier (name)) +- parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST); +- +- /* Ancient backwards compatibility. Old versions of bash exported +- functions like name()=() {...} */ +- if (name[char_index - 1] == ')' && name[char_index - 2] == '(') +- name[char_index - 2] = '\0'; ++ /* Don't import function names that are invalid identifiers from the ++ environment, though we still allow them to be defined as shell ++ variables. */ ++ if (legal_identifier (name)) ++ parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); + + if (temp_var = find_function (name)) + { +@@ -381,10 +379,6 @@ + last_command_exit_value = 1; + report_error (_("error importing function definition for `%s'"), name); + } +- +- /* ( */ +- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0') +- name[char_index - 2] = '('; /* ) */ + } + #if defined (ARRAY_VARS) + # if ARRAY_EXPORT +Index: bash-4.3/subst.c +=================================================================== +--- bash-4.3.orig/subst.c 2014-01-23 13:26:37.000000000 -0800 ++++ bash-4.3/subst.c 2014-09-26 08:40:24.708080056 -0700 +@@ -8029,7 +8029,9 @@ + + goto return0; + } +- else if (var = find_variable_last_nameref (temp1)) ++ else if (var && (invisible_p (var) || var_isset (var) == 0)) ++ temp = (char *)NULL; ++ else if ((var = find_variable_last_nameref (temp1)) && var_isset (var) && invisible_p (var) == 0) + { + temp = nameref_cell (var); + #if defined (ARRAY_VARS) +Index: bash-4.3/builtins/common.h +=================================================================== +--- bash-4.3.orig/builtins/common.h 2013-07-08 13:54:47.000000000 -0700 ++++ bash-4.3/builtins/common.h 2014-09-26 08:40:24.700080056 -0700 +@@ -33,6 +33,8 @@ + #define SEVAL_RESETLINE 0x010 + #define SEVAL_PARSEONLY 0x020 + #define SEVAL_NOLONGJMP 0x040 ++#define SEVAL_FUNCDEF 0x080 /* only allow function definitions */ ++#define SEVAL_ONECMD 0x100 /* only allow a single command */ + + /* Flags for describe_command, shared between type.def and command.def */ + #define CDESC_ALL 0x001 /* type -a */ +Index: bash-4.3/builtins/evalstring.c +=================================================================== +--- bash-4.3.orig/builtins/evalstring.c 2014-02-11 06:42:10.000000000 -0800 ++++ bash-4.3/builtins/evalstring.c 2014-09-26 08:40:24.700080056 -0700 +@@ -308,6 +308,14 @@ + { + struct fd_bitmap *bitmap; + ++ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) ++ { ++ internal_warning ("%s: ignoring function definition attempt", from_file); ++ should_jump_to_top_level = 0; ++ last_result = last_command_exit_value = EX_BADUSAGE; ++ break; ++ } ++ + bitmap = new_fd_bitmap (FD_BITMAP_SIZE); + begin_unwind_frame ("pe_dispose"); + add_unwind_protect (dispose_fd_bitmap, bitmap); +@@ -368,6 +376,9 @@ + dispose_command (command); + dispose_fd_bitmap (bitmap); + discard_unwind_frame ("pe_dispose"); ++ ++ if (flags & SEVAL_ONECMD) ++ break; + } + } + else diff --git a/meta/recipes-extended/bash/bash_3.2.48.bb b/meta/recipes-extended/bash/bash_3.2.48.bb index fe04b28..07c6540 100644 --- a/meta/recipes-extended/bash/bash_3.2.48.bb +++ b/meta/recipes-extended/bash/bash_3.2.48.bb @@ -12,6 +12,7 @@ SRC_URI = "${GNU_MIRROR}/bash/bash-${PV}.tar.gz;name=tarball \ file://mkbuiltins_have_stringize.patch \ file://build-tests.patch \ file://test-output.patch \ + file://shellshock.patch \ file://run-ptest \ " diff --git a/meta/recipes-extended/bash/bash_4.3.bb b/meta/recipes-extended/bash/bash_4.3.bb index 25b7410..a01fcf1 100644 --- a/meta/recipes-extended/bash/bash_4.3.bb +++ b/meta/recipes-extended/bash/bash_4.3.bb @@ -9,6 +9,7 @@ SRC_URI = "${GNU_MIRROR}/bash/${BPN}-${PV}.tar.gz;name=tarball \ file://mkbuiltins_have_stringize.patch \ file://build-tests.patch \ file://test-output.patch \ + file://shellshock.patch \ file://run-ptest \ "