From: Marius Bakke <mbakke@fastmail.com>
To: 30416@debbugs.gnu.org, leo@famulari.name
Subject: [bug#30416] [PATCH] gnu: libtasn1: Fix CVE-2018-6003.
Date: Sun, 11 Feb 2018 02:31:08 +0100 [thread overview]
Message-ID: <E28C32AC-C28E-406E-83FA-AFDCD251CEA4@fastmail.com> (raw)
In-Reply-To: <d623c91d7b97598f497c41c513162e0d027ef31f.1518299682.git.leo@famulari.name>
On February 10, 2018 10:54:44 PM GMT+01:00, Leo Famulari <leo@famulari.name> wrote:
>* gnu/packages/patches/libtasn1-CVE-2018-6003.patch: New file.
>* gnu/local.mk (dist_patch_DATA): Add it.
>* gnu/packages/tls.scm (libtasn1/fixed)[source]: Use it.
LGTM. I think we already ungrafted the fixed version on core-updates, so I guess we should merge and "re-graft" this new patch.
>---
> gnu/local.mk | 1 +
>gnu/packages/patches/libtasn1-CVE-2018-6003.patch | 73
>+++++++++++++++++++++++
> gnu/packages/tls.scm | 3 +-
> 3 files changed, 76 insertions(+), 1 deletion(-)
> create mode 100644 gnu/packages/patches/libtasn1-CVE-2018-6003.patch
>
>diff --git a/gnu/local.mk b/gnu/local.mk
>index eb968dede..9b32e5880 100644
>--- a/gnu/local.mk
>+++ b/gnu/local.mk
>@@ -852,6 +852,7 @@ dist_patch_DATA = \
> %D%/packages/patches/libssh2-fix-build-failure-with-gcrypt.patch \
> %D%/packages/patches/libtar-CVE-2013-4420.patch \
> %D%/packages/patches/libtasn1-CVE-2017-10790.patch \
>+ %D%/packages/patches/libtasn1-CVE-2018-6003.patch \
> %D%/packages/patches/libtheora-config-guess.patch \
> %D%/packages/patches/libtiff-CVE-2016-10688.patch \
> %D%/packages/patches/libtiff-CVE-2017-9936.patch \
>diff --git a/gnu/packages/patches/libtasn1-CVE-2018-6003.patch
>b/gnu/packages/patches/libtasn1-CVE-2018-6003.patch
>new file mode 100644
>index 000000000..3e6140518
>--- /dev/null
>+++ b/gnu/packages/patches/libtasn1-CVE-2018-6003.patch
>@@ -0,0 +1,73 @@
>+Fix CVE-2018-6003:
>+
>+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6003
>+https://lists.gnu.org/archive/html/help-libtasn1/2018-01/msg00000.html
>+
>+Patch copied from upstream source repository:
>+
>+https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97
>+
>+From c593ae84cfcde8fea45787e53950e0ac71e9ca97 Mon Sep 17 00:00:00 2001
>+From: Nikos Mavrogiannopoulos <nmav@redhat.com>
>+Date: Thu, 4 Jan 2018 10:52:05 +0100
>+Subject: [PATCH] _asn1_decode_simple_ber: restrict the levels of
>recursion to 3
>+
>+On indefinite string decoding, setting a maximum level of recursions
>+protects the BER decoder from a stack exhaustion due to large amounts
>+of recursion.
>+
>+Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
>+---
>+ lib/decoding.c | 21 +++++++++++++++++++--
>+ 1 file changed, 19 insertions(+), 2 deletions(-)
>+
>+diff --git a/lib/decoding.c b/lib/decoding.c
>+index 2240b09..0ee35d3 100644
>+--- a/lib/decoding.c
>++++ b/lib/decoding.c
>+@@ -45,6 +45,13 @@
>+
>+ #define DECODE_FLAG_HAVE_TAG 1
>+ #define DECODE_FLAG_INDEFINITE (1<<1)
>++/* On indefinite string decoding, allow this maximum levels
>++ * of recursion. Allowing infinite recursion, makes the BER
>++ * decoder susceptible to stack exhaustion due to that recursion.
>++ */
>++#define DECODE_FLAG_LEVEL1 (1<<2)
>++#define DECODE_FLAG_LEVEL2 (1<<3)
>++#define DECODE_FLAG_LEVEL3 (1<<4)
>+
>+ #define DECR_LEN(l, s) do { \
>+ l -= s; \
>+@@ -2216,7 +2223,8 @@ _asn1_decode_simple_ber (unsigned int etype,
>const unsigned char *der,
>+ }
>+
>+ /* indefinite constructed */
>+- if (((dflags & DECODE_FLAG_INDEFINITE) || class ==
>ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype))
>++ if ((((dflags & DECODE_FLAG_INDEFINITE) || class ==
>ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) &&
>++ !(dflags & DECODE_FLAG_LEVEL3))
>+ {
>+ len_len = 1;
>+
>+@@ -2236,8 +2244,17 @@ _asn1_decode_simple_ber (unsigned int etype,
>const unsigned char *der,
>+ do
>+ {
>+ unsigned tmp_len;
>++ unsigned flags = DECODE_FLAG_HAVE_TAG;
>++
>++ if (dflags & DECODE_FLAG_LEVEL1)
>++ flags |= DECODE_FLAG_LEVEL2;
>++ else if (dflags & DECODE_FLAG_LEVEL2)
>++ flags |= DECODE_FLAG_LEVEL3;
>++ else
>++ flags |= DECODE_FLAG_LEVEL1;
>+
>+- result = asn1_decode_simple_ber(etype, p, der_len, &out,
>&out_len, &tmp_len);
>++ result = _asn1_decode_simple_ber(etype, p, der_len, &out,
>&out_len, &tmp_len,
>++ flags);
>+ if (result != ASN1_SUCCESS)
>+ {
>+ warn();
>+--
>+libgit2 0.26.0
>+
>diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
>index fa58f90cb..c2123add4 100644
>--- a/gnu/packages/tls.scm
>+++ b/gnu/packages/tls.scm
>@@ -91,7 +91,8 @@ specifications.")
> (inherit libtasn1)
> (source (origin
> (inherit (package-source libtasn1))
>- (patches (search-patches
>"libtasn1-CVE-2017-10790.patch"))))))
>+ (patches (search-patches "libtasn1-CVE-2017-10790.patch"
>+
>"libtasn1-CVE-2018-6003.patch"))))))
>
> (define-public asn1c
> (package
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
next prev parent reply other threads:[~2018-02-11 1:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-10 21:54 [bug#30416] [PATCH] gnu: libtasn1: Fix CVE-2018-6003 Leo Famulari
2018-02-11 1:31 ` Marius Bakke [this message]
2018-02-11 4:02 ` bug#30416: " Leo Famulari
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E28C32AC-C28E-406E-83FA-AFDCD251CEA4@fastmail.com \
--to=mbakke@fastmail.com \
--cc=30416@debbugs.gnu.org \
--cc=leo@famulari.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).