binutils CVEs

binutils CVEs

[Efraim Flashner]

[-- Attachment #1.1: Type: text/plain, Size: 685 bytes --]

There's a large number of CVEs against binutils@2.28. Gentoo¹ has a nice
long list of the CVEs, and I've put together a patch to graft a
replacement, but I'm getting grafting errors:
ERROR: replacement length differs from the original length "h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28" "wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"

I've attached the patch in case anyone has any ideas on how to fix this.

¹ https://security.gentoo.org/glsa/201709-02

-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #1.2: 0001-gnu-binutils-Fix-security-issues.patch --]
[-- Type: text/plain, Size: 2704 bytes --]

From 949c3adbf3d2c576356eaf47c0c67ad711b2e4e7 Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efraim@flashner.co.il>
Date: Sun, 17 Sep 2017 21:13:22 +0300
Subject: [PATCH] gnu: binutils: Fix security issues.

* gnu/packages/base.scm (binutils)[replacement]: New field.
(binutils/fixed): New variable.
* gnu/packages/commencement.scm (binutils-boot0, binutils-final): Use
'package/inherit' to correctly use replacement binutils.
---
 gnu/packages/base.scm         | 14 ++++++++++++++
 gnu/packages/commencement.scm |  5 +++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 1ccff1fcf5..56a870552c 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -394,6 +394,7 @@ change.  GNU make offers many powerful extensions over the standard utility.")
 
 (define-public binutils
   (package
+   (replacement binutils/fixed)
    (name "binutils")
    (version "2.28")
    (source (origin
@@ -435,6 +436,19 @@ included.")
    (license gpl3+)
    (home-page "https://www.gnu.org/software/binutils/")))
 
+(define binutils/fixed
+  (package
+    (inherit binutils)
+    (version "2.28.1")
+    (source 
+      (origin (inherit (package-source binutils))
+              (uri (string-append "mirror://gnu/binutils/binutils-"
+                                  version ".tar.bz2"))
+              (sha256
+               (base32
+                "1sj234nd05cdgga1r36zalvvdkvpfbr12g5mir2n8i1dwsdrj939"))))))
+
+
 (define* (make-ld-wrapper name #:key
                           (target (const #f))
                           binutils
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 7bbe1becd9..ec7677814f 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015, 2017 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -139,7 +140,7 @@
 
 (define binutils-boot0
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (name "binutils-cross-boot0")
      (arguments
       `(#:guile ,%bootstrap-guile
@@ -667,7 +668,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
 
 (define binutils-final
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (arguments
       `(#:guile ,%bootstrap-guile
         #:implicit-inputs? #f
-- 
2.14.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: binutils CVEs

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 641 bytes --]

Efraim Flashner <efraim@flashner.co.il> writes:

> There's a large number of CVEs against binutils@2.28. Gentoo¹ has a nice
> long list of the CVEs, and I've put together a patch to graft a
> replacement, but I'm getting grafting errors:
> ERROR: replacement length differs from the original length "h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28" "wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"

This is because the replacement name is two bytes longer (.1).

To fix it, the version field of the replacement must be set to something
with equal length of "2.28".  I suppose we can use just that and
hard-code the source URL?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: binutils CVEs

[Efraim Flashner]

On September 17, 2017 9:25:11 PM GMT+03:00, Marius Bakke <mbakke@fastmail.com> wrote:
>Efraim Flashner <efraim@flashner.co.il> writes:
>
>> There's a large number of CVEs against binutils@2.28. Gentoo¹ has a
>nice
>> long list of the CVEs, and I've put together a patch to graft a
>> replacement, but I'm getting grafting errors:
>> ERROR: replacement length differs from the original length
>"h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28"
>"wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"
>
>This is because the replacement name is two bytes longer (.1).
>
>To fix it, the version field of the replacement must be set to
>something
>with equal length of "2.28".  I suppose we can use just that and
>hard-code the source URL?

That is the obvious solution, but I don't like it. It does make it harder to verify that it's grafted correctly but I guess it'll just have to be that way.


-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: binutils CVEs

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1008 bytes --]

Efraim Flashner <efraim@flashner.co.il> writes:

> On September 17, 2017 9:25:11 PM GMT+03:00, Marius Bakke <mbakke@fastmail.com> wrote:
>>Efraim Flashner <efraim@flashner.co.il> writes:
>>
>>> There's a large number of CVEs against binutils@2.28. Gentoo¹ has a
>>nice
>>> long list of the CVEs, and I've put together a patch to graft a
>>> replacement, but I'm getting grafting errors:
>>> ERROR: replacement length differs from the original length
>>"h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28"
>>"wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"
>>
>>This is because the replacement name is two bytes longer (.1).
>>
>>To fix it, the version field of the replacement must be set to
>>something
>>with equal length of "2.28".  I suppose we can use just that and
>>hard-code the source URL?
>
> That is the obvious solution, but I don't like it. It does make it harder to verify that it's grafted correctly but I guess it'll just have to be that way.

Maybe "2281".  Or "fixd".

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: binutils CVEs

[Ludovic Courtès]

Marius Bakke <mbakke@fastmail.com> skribis:

> Efraim Flashner <efraim@flashner.co.il> writes:
>
>> On September 17, 2017 9:25:11 PM GMT+03:00, Marius Bakke <mbakke@fastmail.com> wrote:
>>>Efraim Flashner <efraim@flashner.co.il> writes:
>>>
>>>> There's a large number of CVEs against binutils@2.28. Gentoo¹ has a
>>>nice
>>>> long list of the CVEs, and I've put together a patch to graft a
>>>> replacement, but I'm getting grafting errors:
>>>> ERROR: replacement length differs from the original length
>>>"h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28"
>>>"wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"
>>>
>>>This is because the replacement name is two bytes longer (.1).
>>>
>>>To fix it, the version field of the replacement must be set to
>>>something
>>>with equal length of "2.28".  I suppose we can use just that and
>>>hard-code the source URL?
>>
>> That is the obvious solution, but I don't like it. It does make it harder to verify that it's grafted correctly but I guess it'll just have to be that way.
>
> Maybe "2281".  Or "fixd".

Or “2.2A”?

Ludo’.