bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

[Leo Famulari]

An attacker-controlled memory corruption vulnerability was discovered in
NSS:

https://bugs.chromium.org/p/project-zero/issues/detail?id=2237

bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

[Mark H Weaver]

Hi Leo,

Leo Famulari <leo@famulari.name> writes:
> An attacker-controlled memory corruption vulnerability was discovered in
> NSS:
>
> https://bugs.chromium.org/p/project-zero/issues/detail?id=2237

Thanks for bringing this to our attention.  I just pushed a new
'gnuzilla-updates' branch, which is 'master' plus two new commits:

--8<---------------cut here---------------start------------->8---
commit 0863c665ebc54046baac7db1fde1f1f0e24476d0
Author: Mark H Weaver <mhw@netris.org>
Date:   Thu Dec 2 20:23:16 2021 -0500

  UNTESTED: gnu: nss: Fix CVE-2021-43527 via graft.
  
  * gnu/packages/patches/nss-CVE-2021-43527.patch: New file.
  * gnu/local.mk (dist_patch_DATA): Add it.
  * gnu/packages/nss.scm (nss/fixed): New variable
  (nss)[replacement]: New field.

commit bc6afae2466017d1a19725a86e69e666249a1b71
Author: Mark H Weaver <mhw@netris.org>
Date:   Thu Dec 2 20:14:05 2021 -0500

  UNTESTED: gnu: icecat: Fix CVE-2021-43527.
  
  * gnu/packages/patches/icecat-CVE-2021-43527.patch: New file.
  * gnu/local.mk (dist_patch_DATA): Add it.
  * gnu/packages/gnuzilla.scm (icecat-source): Apply it.
--8<---------------cut here---------------end--------------->8---

As the summary lines indicate, I haven't yet tested these patches, apart
from verifying that the patched sources are built correctly.

If I'm not mistaken, ci.guix.gnu.org will soon evaluate the
'gnuzilla-updates' branch and perform the necessary rebuilds.
If all goes well, I'll cherry-pick these commits to 'master'.

If someone else verifies that the commits are good before I get to it,
please feel free to cherry-pick them to 'master' on my behalf (with the
"UNTESTED: " prefixes removed, of course).

     Regards,
       Mark

-- 
Disinformation flourishes because many people care deeply about injustice
but very few check the facts.  Ask me about <https://stallmansupport.org>.

bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

[Mark H Weaver]

Hi,

For the record, I've pushed commits
080a5de2eeb5e0da83ae9fd94488508d5227c4e3 and
d49e7a592f2f12cd1f9e07edfeebe0a2771f491e to the 'master' branch, which I
believe should fix this issue in our 'nss', 'icecat', 'icedove',
'icedove-wayland', and 'geierlein' packages.

Does anyone know if there are other packages in Guix that include a
bundled copy of NSS?  If not, I guess this bug can be closed.

      Thanks,
        Mark

-- 
Disinformation flourishes because many people care deeply about injustice
but very few check the facts.  Ask me about <https://stallmansupport.org>.

bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

[Leo Famulari]

On Fri, Dec 03, 2021 at 07:28:18PM -0500, Mark H Weaver wrote:
> Hi,
> 
> For the record, I've pushed commits
> 080a5de2eeb5e0da83ae9fd94488508d5227c4e3 and
> d49e7a592f2f12cd1f9e07edfeebe0a2771f491e to the 'master' branch, which I
> believe should fix this issue in our 'nss', 'icecat', 'icedove',
> 'icedove-wayland', and 'geierlein' packages.

Thanks for working on it, Mark.

> Does anyone know if there are other packages in Guix that include a
> bundled copy of NSS?  If not, I guess this bug can be closed.

Personally I don't know... I hope not. Let's wait a couple more days
before closing.

bug#52228: NSS CVE-2021-43527 "memory corruption validating dsa/rsa-pss signatures"

[Maxim Cournoyer]

Hello,

Leo Famulari <leo@famulari.name> writes:

> On Fri, Dec 03, 2021 at 07:28:18PM -0500, Mark H Weaver wrote:
>> Hi,
>> 
>> For the record, I've pushed commits
>> 080a5de2eeb5e0da83ae9fd94488508d5227c4e3 and
>> d49e7a592f2f12cd1f9e07edfeebe0a2771f491e to the 'master' branch, which I
>> believe should fix this issue in our 'nss', 'icecat', 'icedove',
>> 'icedove-wayland', and 'geierlein' packages.
>
> Thanks for working on it, Mark.
>
>> Does anyone know if there are other packages in Guix that include a
>> bundled copy of NSS?  If not, I guess this bug can be closed.
>
> Personally I don't know... I hope not. Let's wait a couple more days
> before closing.

It's been 15 weeks :-).

Closing.

Maxim