<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
.MsoChpDefault
        {mso-style-type:export-only;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">The patches are all same. There was an error in the subject due to which it wasn’t reflecting in the submitted patches on open embedded core.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sent from <a href="https://go.microsoft.com/fwlink/?LinkId=550986">
Mail</a> for Windows 10</p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> akuster808 <akuster808@gmail.com><br>
<b>Sent:</b> Monday, September 23, 2019 2:19:15 PM<br>
<b>To:</b> Shubham Agrawal <shuagr@microsoft.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org><br>
<b>Subject:</b> Re: [OE-core] [”OE-core][thud][PATCH”] elfutils: CVE fix for elfutils</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText"><br>
<br>
On 9/23/19 2:14 PM, shuagr97@gmail.com wrote:<br>
> From: Shubham Agrawal <shuagr@microsoft.com><br>
><br>
> CVE: CVE-2019-7664.patch<br>
> CVE: CVE-2019-7665.patch<br>
<br>
This is the third email patch on the same issues. Are they different?<br>
<br>
regards,<br>
Armin<br>
><br>
> Sign off: Shubham Agrawal <shuagr@microsoft.com><br>
> ---<br>
> meta/recipes-devtools/elfutils/elfutils_0.175.bb | 2 +<br>
> .../elfutils/files/CVE-2019-7664.patch | 65 +++++++++<br>
> .../elfutils/files/CVE-2019-7665.patch | 154 +++++++++++++++++++++<br>
> 3 files changed, 221 insertions(+)<br>
> create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch<br>
> create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch<br>
><br>
> diff --git a/meta/recipes-devtools/elfutils/elfutils_0.175.bb b/meta/recipes-devtools/elfutils/elfutils_0.175.bb<br>
> index e94a48e..862a9b6 100644<br>
> --- a/meta/recipes-devtools/elfutils/elfutils_0.175.bb<br>
> +++ b/meta/recipes-devtools/elfutils/elfutils_0.175.bb<br>
> @@ -31,6 +31,8 @@ SRC_URI = "<a href=""></a>https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsourceware.org%2Felfutils%2Fftp%2F%24&amp;data=02%7C01%7Cshuagr%40microsoft.com%7C0a3b7e85865a440119d508d7406bb255%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637048703613961219&amp;sdata=J1z7WGLoV1xEpBxRaWekNFf0HDIvmCtUMpLYUb1nR%2Fk%3D&amp;reserved=0{PV}/${BP}.tar.bz2
\<br>
> <a href="file://CVE-2019-7150.patch">file://CVE-2019-7150.patch</a> \<br>
> <a href="file://CVE-2019-7146_p1.patch">file://CVE-2019-7146_p1.patch</a> \<br>
> <a href="file://CVE-2019-7146_p2.patch">file://CVE-2019-7146_p2.patch</a> \<br>
> + <a href="file://CVE-2019-7664.patch">file://CVE-2019-7664.patch</a> \<br>
> + <a href="file://CVE-2019-7665.patch">file://CVE-2019-7665.patch</a> \<br>
> "<br>
> SRC_URI_append_libc-musl = " <a href="file://0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch">
file://0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch</a>"<br>
> <br>
> diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch<br>
> new file mode 100644<br>
> index 0000000..e55dc5a<br>
> --- /dev/null<br>
> +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch<br>
> @@ -0,0 +1,65 @@<br>
> +From 3ed05376e7b2c96c1d6eb24d2842cc25b79a4f07 Mon Sep 17 00:00:00 2001<br>
> +From: Mark Wielaard <mark@klomp.org><br>
> +Date: Wed, 16 Jan 2019 12:25:57 +0100<br>
> +Subject: [PATCH] CVE: CVE-2019-7664<br>
> +<br>
> +Upstream-Status: Backport<br>
> +libelf: Correct overflow check in note_xlate.<br>
> +<br>
> +We want to make sure the note_len doesn't overflow and becomes shorter<br>
> +than the note header. But the namesz and descsz checks got the note header<br>
> +size wrong). Replace the wrong constant (8) with a sizeof cvt_Nhdr (12).<br>
> +<br>
> +https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsourceware.org%2Fbugzilla%2Fshow_bug.cgi%3Fid%3D24084&amp;data=02%7C01%7Cshuagr%40microsoft.com%7C0a3b7e85865a440119d508d7406bb255%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637048703613961219&amp;sdata=XDpI1uUOmF4w%2FdtsO%2BspaDCLIOEdoGQr6PNxaJh3u%2Fc%3D&amp;reserved=0<br>
> +<br>
> +Signed-off-by: Mark Wielaard <mark@klomp.org><br>
> +Signed-off-by: Ubuntu <lisa@shuagr-yocto-build.mdn4q2lr1oauhmizmzsslly3ad.xx.internal.cloudapp.net><br>
> +---<br>
> + libelf/ChangeLog | 13 +++++++++++++<br>
> + libelf/note_xlate.h | 4 ++--<br>
> + 2 files changed, 15 insertions(+), 2 deletions(-)<br>
> +<br>
> +diff --git a/libelf/ChangeLog b/libelf/ChangeLog<br>
> +index 68c4fbd..892e6e7 100644<br>
> +--- a/libelf/ChangeLog<br>
> ++++ b/libelf/ChangeLog<br>
> +@@ -1,3 +1,16 @@<br>
> ++<<<<<<< HEAD<br>
> ++=======<br>
> ++2019-01-16 Mark Wielaard <mark@klomp.org><br>
> ++<br>
> ++ * note_xlate.h (elf_cvt_note): Check n_namesz and n_descsz don't<br>
> ++ overflow note_len into note header.<br>
> ++<br>
> ++2018-11-17 Mark Wielaard <mark@klomp.org><br>
> ++<br>
> ++ * elf32_updatefile.c (updatemmap): Make sure to call convert<br>
> ++ function on a properly aligned destination.<br>
> ++<br>
> ++>>>>>>> e65d91d... libelf: Correct overflow check in note_xlate.<br>
> + 2018-11-16 Mark Wielaard <mark@klomp.org><br>
> + <br>
> + * libebl.h (__elf32_msize): Mark with const attribute.<br>
> +diff --git a/libelf/note_xlate.h b/libelf/note_xlate.h<br>
> +index 9bdc3e2..bc9950f 100644<br>
> +--- a/libelf/note_xlate.h<br>
> ++++ b/libelf/note_xlate.h<br>
> +@@ -46,13 +46,13 @@ elf_cvt_note (void *dest, const void *src, size_t len, int encode,<br>
> + /* desc needs to be aligned. */<br>
> + note_len += n->n_namesz;<br>
> + note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len);<br>
> +- if (note_len > len || note_len < 8)<br>
> ++ if (note_len > len || note_len < sizeof *n)<br>
> + break;<br>
> + <br>
> + /* data as a whole needs to be aligned. */<br>
> + note_len += n->n_descsz;<br>
> + note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len);<br>
> +- if (note_len > len || note_len < 8)<br>
> ++ if (note_len > len || note_len < sizeof *n)<br>
> + break;<br>
> + <br>
> + /* Copy or skip the note data. */<br>
> +-- <br>
> +2.7.4<br>
> +<br>
> diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch<br>
> new file mode 100644<br>
> index 0000000..a1bb309<br>
> --- /dev/null<br>
> +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch<br>
> @@ -0,0 +1,154 @@<br>
> +From 4323d46c4a369b614aa1f574805860b3434552df Mon Sep 17 00:00:00 2001<br>
> +From: Mark Wielaard <mark@klomp.org><br>
> +Date: Wed, 16 Jan 2019 15:41:31 +0100<br>
> +Subject: [PATCH] CVE: CVE-2019-7665<br>
> +<br>
> +Upstream-Status: Backport<br>
> +<br>
> +Sign off: Shubham Agrawal <shuagr@microsoft.com><br>
> +<br>
> +libebl: Check NT_PLATFORM core notes contain a zero terminated string.<br>
> +<br>
> +Most strings in core notes are fixed size. But NT_PLATFORM contains just<br>
> +a variable length string. Check that it is actually zero terminated<br>
> +before passing to readelf to print.<br>
> +<br>
> +https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsourceware.org%2Fbugzilla%2Fshow_bug.cgi%3Fid%3D24089&amp;data=02%7C01%7Cshuagr%40microsoft.com%7C0a3b7e85865a440119d508d7406bb255%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637048703613961219&amp;sdata=WQe4updGnCdqEq%2FgiVbXZT%2FWc4sUd%2FoBef7x9f7jGE8%3D&amp;reserved=0<br>
> +<br>
> +Signed-off-by: Mark Wielaard <mark@klomp.org><br>
> +Signed-off-by: Ubuntu <lisa@shuagr-yocto-build.mdn4q2lr1oauhmizmzsslly3ad.xx.internal.cloudapp.net><br>
> +---<br>
> + libdwfl/linux-core-attach.c | 9 +++++----<br>
> + libebl/eblcorenote.c | 39 +++++++++++++++++++--------------------<br>
> + libebl/libebl.h | 3 ++-<br>
> + src/readelf.c | 2 +-<br>
> + 4 files changed, 27 insertions(+), 26 deletions(-)<br>
> +<br>
> +diff --git a/libdwfl/linux-core-attach.c b/libdwfl/linux-core-attach.c<br>
> +index 6c99b9e..c0f1b0d 100644<br>
> +--- a/libdwfl/linux-core-attach.c<br>
> ++++ b/libdwfl/linux-core-attach.c<br>
> +@@ -137,7 +137,7 @@ core_next_thread (Dwfl *dwfl __attribute__ ((unused)), void *dwfl_arg,<br>
> + const Ebl_Register_Location *reglocs;<br>
> + size_t nitems;<br>
> + const Ebl_Core_Item *items;<br>
> +- if (! ebl_core_note (core_arg->ebl, &nhdr, name,<br>
> ++ if (! ebl_core_note (core_arg->ebl, &nhdr, name, desc,<br>
> + &regs_offset, &nregloc, &reglocs, &nitems, &items))<br>
> + {<br>
> + /* This note may be just not recognized, skip it. */<br>
> +@@ -191,8 +191,9 @@ core_set_initial_registers (Dwfl_Thread *thread, void *thread_arg_voidp)<br>
> + const Ebl_Register_Location *reglocs;<br>
> + size_t nitems;<br>
> + const Ebl_Core_Item *items;<br>
> +- int core_note_err = ebl_core_note (core_arg->ebl, &nhdr, name, &regs_offset,<br>
> +- &nregloc, &reglocs, &nitems, &items);<br>
> ++ int core_note_err = ebl_core_note (core_arg->ebl, &nhdr, name, desc,<br>
> ++ &regs_offset, &nregloc, &reglocs,<br>
> ++ &nitems, &items);<br>
> + /* __libdwfl_attach_state_for_core already verified the note is there. */<br>
> + assert (core_note_err != 0);<br>
> + assert (nhdr.n_type == NT_PRSTATUS);<br>
> +@@ -383,7 +384,7 @@ dwfl_core_file_attach (Dwfl *dwfl, Elf *core)<br>
> + const Ebl_Register_Location *reglocs;<br>
> + size_t nitems;<br>
> + const Ebl_Core_Item *items;<br>
> +- if (! ebl_core_note (ebl, &nhdr, name,<br>
> ++ if (! ebl_core_note (ebl, &nhdr, name, desc,<br>
> + &regs_offset, &nregloc, &reglocs, &nitems, &items))<br>
> + {<br>
> + /* This note may be just not recognized, skip it. */<br>
> +diff --git a/libebl/eblcorenote.c b/libebl/eblcorenote.c<br>
> +index 783f981..7fab397 100644<br>
> +--- a/libebl/eblcorenote.c<br>
> ++++ b/libebl/eblcorenote.c<br>
> +@@ -36,11 +36,13 @@<br>
> + #include <inttypes.h><br>
> + #include <stdio.h><br>
> + #include <stddef.h><br>
> ++#include <string.h><br>
> + #include <libeblP.h><br>
> + <br>
> + <br>
> + int<br>
> + ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name,<br>
> ++ const char *desc,<br>
> + GElf_Word *regs_offset, size_t *nregloc,<br>
> + const Ebl_Register_Location **reglocs, size_t *nitems,<br>
> + const Ebl_Core_Item **items)<br>
> +@@ -51,28 +53,25 @@ ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name,<br>
> + {<br>
> + /* The machine specific function did not know this type. */<br>
> + <br>
> +- *regs_offset = 0;<br>
> +- *nregloc = 0;<br>
> +- *reglocs = NULL;<br>
> +- switch (nhdr->n_type)<br>
> ++ /* NT_PLATFORM is kind of special since it needs a zero terminated<br>
> ++ string (other notes often have a fixed size string). */<br>
> ++ static const Ebl_Core_Item platform[] =<br>
> + {<br>
> +-#define ITEMS(type, table) \<br>
> +- case type: \<br>
> +- *items = table; \<br>
> +- *nitems = sizeof table / sizeof table[0]; \<br>
> +- result = 1; \<br>
> +- break<br>
> ++ {<br>
> ++ .name = "Platform",<br>
> ++ .type = ELF_T_BYTE, .count = 0, .format = 's'<br>
> ++ }<br>
> ++ };<br>
> + <br>
> +- static const Ebl_Core_Item platform[] =<br>
> +- {<br>
> +- {<br>
> +- .name = "Platform",<br>
> +- .type = ELF_T_BYTE, .count = 0, .format = 's'<br>
> +- }<br>
> +- };<br>
> +- ITEMS (NT_PLATFORM, platform);<br>
> +-<br>
> +-#undef ITEMS<br>
> ++ if (nhdr->n_type == NT_PLATFORM<br>
> ++ && memchr (desc, '\0', nhdr->n_descsz) != NULL)<br>
> ++ {<br>
> ++ *regs_offset = 0;<br>
> ++ *nregloc = 0;<br>
> ++ *reglocs = NULL;<br>
> ++ *items = platform;<br>
> ++ *nitems = 1;<br>
> ++ result = 1;<br>
> + }<br>
> + }<br>
> + <br>
> +diff --git a/libebl/libebl.h b/libebl/libebl.h<br>
> +index ca9b9fe..24922eb 100644<br>
> +--- a/libebl/libebl.h<br>
> ++++ b/libebl/libebl.h<br>
> +@@ -319,7 +319,8 @@ typedef struct<br>
> + <br>
> + /* Describe the format of a core file note with the given header and NAME.<br>
> + NAME is not guaranteed terminated, it's NHDR->n_namesz raw bytes. */<br>
> +-extern int ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name,<br>
> ++extern int ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr,<br>
> ++ const char *name, const char *desc,<br>
> + GElf_Word *regs_offset, size_t *nregloc,<br>
> + const Ebl_Register_Location **reglocs,<br>
> + size_t *nitems, const Ebl_Core_Item **items)<br>
> +diff --git a/src/readelf.c b/src/readelf.c<br>
> +index 3a73710..71651e0 100644<br>
> +--- a/src/readelf.c<br>
> ++++ b/src/readelf.c<br>
> +@@ -12153,7 +12153,7 @@ handle_core_note (Ebl *ebl, const GElf_Nhdr *nhdr,<br>
> + size_t nitems;<br>
> + const Ebl_Core_Item *items;<br>
> + <br>
> +- if (! ebl_core_note (ebl, nhdr, name,<br>
> ++ if (! ebl_core_note (ebl, nhdr, name, desc,<br>
> + &regs_offset, &nregloc, &reglocs, &nitems, &items))<br>
> + return;<br>
> + <br>
> +-- <br>
> +2.7.4<br>
> +<br>
<br>
</div>
</span></font></div>
</body>
</html>