From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:8:6d80::]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id SF2kAUhLXmCjQQAAgWs5BA (envelope-from ) for ; Fri, 26 Mar 2021 21:59:52 +0100 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id +DEXN0dLXmDqGAAAB5/wlQ (envelope-from ) for ; Fri, 26 Mar 2021 20:59:51 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 18B101A93D for ; Fri, 26 Mar 2021 21:59:51 +0100 (CET) Received: from localhost ([::1]:33288 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lPtYc-0003DH-9w for larch@yhetil.org; Fri, 26 Mar 2021 16:59:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37992) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lPtHO-0006fy-7K for bug-guix@gnu.org; Fri, 26 Mar 2021 16:42:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:59305) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lPtHN-0007fX-VZ for bug-guix@gnu.org; Fri, 26 Mar 2021 16:42:01 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lPtHN-0002Jc-T6 for bug-guix@gnu.org; Fri, 26 Mar 2021 16:42:01 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#47420: binutils is vulnerable to CVE-2021-20197 (and various others) Resent-From: =?UTF-8?Q?L=C3=A9o?= Le Bouter Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Fri, 26 Mar 2021 20:42:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 47420 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 47420@debbugs.gnu.org X-Debbugs-Original-To: bug-guix@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.16167912928863 (code B ref -1); Fri, 26 Mar 2021 20:42:01 +0000 Received: (at submit) by debbugs.gnu.org; 26 Mar 2021 20:41:32 +0000 Received: from localhost ([127.0.0.1]:42618 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lPtGt-0002Is-Qa for submit@debbugs.gnu.org; Fri, 26 Mar 2021 16:41:32 -0400 Received: from lists.gnu.org ([209.51.188.17]:58216) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lPtGs-0002Il-KK for submit@debbugs.gnu.org; Fri, 26 Mar 2021 16:41:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37888) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lPtGs-0005en-9K for bug-guix@gnu.org; Fri, 26 Mar 2021 16:41:30 -0400 Received: from mail.zaclys.net ([178.33.93.72]:54763) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lPtGp-0007Q7-J0 for bug-guix@gnu.org; Fri, 26 Mar 2021 16:41:29 -0400 Received: from guix-xps.local (82-64-145-38.subs.proxad.net [82.64.145.38]) (authenticated bits=0) by mail.zaclys.net (8.14.7/8.14.7) with ESMTP id 12QKfOMl009514 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Fri, 26 Mar 2021 21:41:24 +0100 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.zaclys.net 12QKfOMl009514 Authentication-Results: mail.zaclys.net; spf=fail smtp.mailfrom=lle-bout@zaclys.net DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zaclys.net; s=default; t=1616791284; bh=PAz5eH5dR70EQ4IYaki03UgvN47z6WiA3uzbsxJ2zCA=; h=Subject:From:To:Date:From; b=gb0s5bP74VC/U7qpWSjuWrAUxHN6/+NSAfZIQIcrLpN8NS4FwO4l0NyYLaVIwZMPJ JyNgSuk4iTlNVmgNNm8IH1m2Wpxy617EXEEVX/gFOFF12ThOihugGX3tZ41wIyhxAV 9izK+XHNKApt/UPry45y17otI5GIs51oy48oW7Dc= Message-ID: <669bea321d23f39ac5bb902dc930f4056f07ec78.camel@zaclys.net> Date: Fri, 26 Mar 2021 21:41:20 +0100 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-j5FKG5V+VjaTh3Lnpq4o" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 Received-SPF: pass client-ip=178.33.93.72; envelope-from=lle-bout@zaclys.net; helo=mail.zaclys.net X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" Reply-to: =?UTF-8?Q?L=C3=A9o?= Le Bouter From: =?UTF-8?Q?L=C3=A9o?= Le Bouter via Bug reports for GNU Guix X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1616792391; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:resent-cc:resent-from:resent-sender: resent-message-id:list-id:list-help:list-unsubscribe:list-subscribe: list-post:dkim-signature; bh=PAz5eH5dR70EQ4IYaki03UgvN47z6WiA3uzbsxJ2zCA=; b=ZFNDLAmDSCja3M6JpvyHF2NfsQLr/0R3Nd7uWpSLnSIYfhNHBPQ5Kj1yhFlxdsqce5VnJD Amkf/B8DAnzgUvjH9d5yU376J/b9/k7y9sP2qhlexjPyvMQOMv/S2T74SqU2GeUF8ljJoh VT7YSTkM1aAABFJIyiBcgAjPO2gTjJgzkaOudMGQZMD78p1MDDBClbNBIaxAddaMv8+BE6 ofypVJ/wBrSDCcNeSZWLVodNkwRUStpgeNCu1TFb/jpdhGMFppg4I7vtyHSC3LTj3Tl4G4 21Pm6M/qeusmVnyh8fOnsrNkGsGKO0U9Fi7IjnTQNpTPJdJ3mjUnC8xdMjulsg== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1616792391; a=rsa-sha256; cv=none; b=OXmBAbvYHgKbCCsHaZvubYvXKRI35aGV92QCPTl+VkM9aRK0WeIem7yLoizzeYQ038wECo vPtd4qX0kdgqnqX/rhaBS3bb1E1GYPE6O2VOhNp9SQuwCtHtU85D/bUNYmMAgpaHgUhoyu T4Qy0J5uxWhLOE+ZOxehtmhZ6oF4fyc2OBj/33Z/53nfhNN4aIUNRLAeOiMY25wC/1Hk5D Ttj3ExRGf9lAckjq8mZzRoaXSk9iwTCZyOYGnNENh7TD5KsJvtrBmiChFrUpNZ80W+0XCn MI9w+KCCvu4nev6HGBvWjwmnEowx+oSG2xr7IGodY+FcTP7LmJPVqSBS4TSNEw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=zaclys.net header.s=default header.b=gb0s5bP7; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Spam-Score: -5.02 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=zaclys.net header.s=default header.b=gb0s5bP7; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Queue-Id: 18B101A93D X-Spam-Score: -5.02 X-Migadu-Scanner: scn0.migadu.com X-TUID: ajgu/qUCppRY --=-j5FKG5V+VjaTh3Lnpq4o Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable CVE-2021-20197 18:15 There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. For the two versions packaged in GNU Guix we have: $ ./pre-inst-env guix lint -c cve binutils@2.33 gnu/packages/base.scm:584:2: binutils@2.33.1: probably vulnerable to CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496, CVE- 2020-35507 $ ./pre-inst-env guix lint -c cve binutils@2.34 gnu/packages/base.scm:571:2: binutils@2.34: probably vulnerable to CVE- 2020-16590, CVE-2020-16591, CVE-2020-16592, CVE-2020-16593, CVE-2020- 16599 Because they are also build tools for GNU Guix itself, we can't fix this in grafts, a review of each and every CVE can be made to evaluate whether we must fix it for GNU Guix's internal usage can be made, but also we should update it and not use any vulnerable version anywhere so we can be certain we didnt miss anything. Can binutils be upgraded just like that? Or must it be upgraded in tandem with GCC and friends? Thank you, L=C3=A9o --=-j5FKG5V+VjaTh3Lnpq4o Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBeRvAACgkQRaix6GvN EKZ8kRAAmAZr1kxoMaGXvAHujdj5yLe4s9U1+YqhBaUr4KI3bU0WKWZfy/+8vERb aDx453sxQFvIRW0g9DpwsJzL9n0+oft+g9C1KYaLgp63w6lhp0cdtkGKDJdYaJyE UulAS/F9W0OrWvp0uDeUikeBuAtniJ8lweApZn6VeMcfQ/WCIIMJ39lZ48mbKYhZ UZXnyQGAEi4Jt+I7pEeoi+TBPeDIuN4YU4mivBiMMgrLnWZdEP1jKywBa5Lukb6G xMlmpkMdye8m8sTbuAmfZJ2IXvjcpwE3NgU05q6n6vOvuHyLuhSJJ5uOltob9I04 HD1UeQOTGvaaDqNBFPpiM5v3abKJKv4ZjHD/MMXdUykAzAsDs93Ls7J5QF6avmu/ ysfJpJNDNSy90Kld3e6VqO4P181Q3+kIVkzyeqbHOe6Md+FVuc7wMNl/oPy92H10 zfcduy1klfSqqgPAUidL75Voti90mttPhAX7SYn7J2nwt0W2NJpbindrXhJwTX0j hbMAJDs0Osh+6StB3BDSsLknx3SN/Frj0UGf8UlelovASAarO9CmJ6W/w/5JPRkK Yk/Npe2iejEzj+GbRhTZH9W5UMchdyoWS5UZw0eY2ArT/g0xdtdqdteKovnla4b0 wai92AvvIuubGc7FeyA5qs788L8u4zhaPrYWiaVQQORUejGvzNM= =jnN8 -----END PGP SIGNATURE----- --=-j5FKG5V+VjaTh3Lnpq4o--