<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 16 August 2017 at 13:28, Chen Qi <span dir="ltr"><<a href="mailto:Qi.Chen@windriver.com" target="_blank">Qi.Chen@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Backport a patch to fix CVE-2017-12424.<br>
<br>
In shadow before 4.5, the newusers tool could be made to manipulate<br>
internal data structures in ways unintended by the authors.<br>
<br>
Reference link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-12424" rel="noreferrer" target="_blank">https://nvd.nist.gov/vuln/<wbr>detail/CVE-2017-12424</a><br>
<br>
CVE: CVE-2017-12424<br></blockquote><div><br></div><div>I don't object to the patch but I'm wondering if there is a reason we are taking the shadow sources from debian instead of the upstream github*? shadow 4.5 seems to have been out for months already but Debian hasn't taken it yet... </div><div><br></div><div>*) <a href="https://github.com/shadow-maint/shadow">https://github.com/shadow-maint/shadow</a></div><div><br></div><div>Jussi</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Signed-off-by: Chen Qi <<a href="mailto:Qi.Chen@windriver.com">Qi.Chen@windriver.com</a>><br>
---<br>
<span class="gmail-"> .../shadow/files/0001-shadow-<wbr>CVE-2017-12424 | 46 ++++++++++++++++++++++<br>
meta/recipes-extended/shadow/<wbr>shadow.inc | 1 +<br>
2 files changed, 47 insertions(+)<br>
create mode 100644 meta/recipes-extended/shadow/<wbr>files/0001-shadow-CVE-2017-<wbr>12424<br>
<br>
</span>diff --git a/meta/recipes-extended/<wbr>shadow/files/0001-shadow-CVE-<wbr>2017-12424 b/meta/recipes-extended/<wbr>shadow/files/0001-shadow-CVE-<wbr>2017-12424<br>
new file mode 100644<br>
index 0000000..4d3e1e0<br>
--- /dev/null<br>
+++ b/meta/recipes-extended/<wbr>shadow/files/0001-shadow-CVE-<wbr>2017-12424<br>
@@ -0,0 +1,46 @@<br>
+From 954e3d2e7113e9ac06632aee3c69b8<wbr>d818cc8952 Mon Sep 17 00:00:00 2001<br>
+From: Tomas Mraz <<a href="mailto:tmraz@fedoraproject.org">tmraz@fedoraproject.org</a>><br>
+Date: Fri, 31 Mar 2017 16:25:06 +0200<br>
+Subject: [PATCH] Fix buffer overflow if NULL line is present in db.<br>
+<br>
+If ptr->line == NULL for an entry, the first cycle will exit,<br>
+but the second one will happily write past entries buffer.<br>
+We actually do not want to exit the first cycle prematurely<br>
+on ptr->line == NULL.<br>
+Signed-off-by: Tomas Mraz <<a href="mailto:tmraz@fedoraproject.org">tmraz@fedoraproject.org</a>><br>
+<br>
+CVE: CVE-2017-12424<br>
+Upstream-Status: Backport<br>
+Signed-off-by: Chen Qi <<a href="mailto:Qi.Chen@windriver.com">Qi.Chen@windriver.com</a>><br>
+---<br>
+ lib/commonio.c | 8 ++++----<br>
+ 1 file changed, 4 insertions(+), 4 deletions(-)<br>
+<br>
+diff --git a/lib/commonio.c b/lib/commonio.c<br>
+index b10da06..31edbaa 100644<br>
+--- a/lib/commonio.c<br>
++++ b/lib/commonio.c<br>
+@@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))<br>
+ for (ptr = db->head;<br>
+ (NULL != ptr)<br>
+ #if KEEP_NIS_AT_END<br>
+- && (NULL != ptr->line)<br>
+- && ( ('+' != ptr->line[0])<br>
+- && ('-' != ptr->line[0]))<br>
++ && ((NULL == ptr->line)<br>
++ || (('+' != ptr->line[0])<br>
++ && ('-' != ptr->line[0])))<br>
+ #endif<br>
+ ;<br>
+ ptr = ptr->next) {<br>
+ n++;<br>
+ }<br>
+ #if KEEP_NIS_AT_END<br>
+- if ((NULL != ptr) && (NULL != ptr->line)) {<br>
++ if (NULL != ptr) {<br>
+ nis = ptr;<br>
+ }<br>
+ #endif<br>
+--<br>
+2.1.0<br>
+<br>
diff --git a/meta/recipes-extended/<wbr>shadow/shadow.inc b/meta/recipes-extended/<wbr>shadow/shadow.inc<br>
index 5e6b0bd..cc18964 100644<br>
--- a/meta/recipes-extended/<wbr>shadow/shadow.inc<br>
+++ b/meta/recipes-extended/<wbr>shadow/shadow.inc<br>
@@ -16,6 +16,7 @@ SRC_URI = "<a href="http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.xz" rel="noreferrer" target="_blank">http://pkg-shadow.alioth.<wbr>debian.org/releases/${BPN}-${<wbr>PV}.tar.xz</a> \<br>
file://0001-Do-not-read-login.<wbr>defs-before-doing-chroot.patch \<br>
file://check_size_of_uid_t_<wbr>and_gid_t_using_AC_CHECK_<wbr>SIZEOF.patch \<br>
file://0001-useradd-copy-<wbr>extended-attributes-of-home.<wbr>patch \<br>
+ file://0001-shadow-CVE-2017-<wbr>12424 \<br>
${@bb.utils.contains('<wbr>PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \<br>
<div class="gmail-HOEnZb"><div class="gmail-h5"> "<br>
<br>
--<br>
1.9.1<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</div></div></blockquote></div><br></div></div>