From ad0bb50dc717a2d9568b73e0f4a509cf6044ffb1 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sun, 12 Nov 2023 20:43:24 +0100 Subject: [PATCH] package/tar: add upstream security patch for CVE-2022-48303 Fixes CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Signed-off-by: Peter Korsgaard [Peter: add _IGNORE_CVES entry] Signed-off-by: Peter Korsgaard --- ...oundary-checking-in-base-256-decoder.patch | 33 +++++++++++++++++++ package/tar/tar.mk | 3 ++ 2 files changed, 36 insertions(+) create mode 100644 package/tar/0002-Fix-boundary-checking-in-base-256-decoder.patch diff --git a/package/tar/0002-Fix-boundary-checking-in-base-256-decoder.patch b/package/tar/0002-Fix-boundary-checking-in-base-256-decoder.patch new file mode 100644 index 0000000000..7bad339fe0 --- /dev/null +++ b/package/tar/0002-Fix-boundary-checking-in-base-256-decoder.patch @@ -0,0 +1,33 @@ +From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff +Date: Sat, 11 Feb 2023 11:57:39 +0200 +Subject: [PATCH] Fix boundary checking in base-256 decoder + +* src/list.c (from_header): Base-256 encoding is at least 2 bytes +long. + +Signed-off-by: Peter Korsgaard +Upstream: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 +--- + src/list.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/list.c b/src/list.c +index 9fafc425..86bcfdd1 100644 +--- a/src/list.c ++++ b/src/list.c +@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, + where++; + } + } +- else if (*where == '\200' /* positive base-256 */ +- || *where == '\377' /* negative base-256 */) ++ else if (where <= lim - 2 ++ && (*where == '\200' /* positive base-256 */ ++ || *where == '\377' /* negative base-256 */)) + { + /* Parse base-256 output. A nonnegative number N is + represented as (256**DIGS)/2 + N; a negative number -N is +-- +2.39.2 + diff --git a/package/tar/tar.mk b/package/tar/tar.mk index 690a5952ba..dc17647b2c 100644 --- a/package/tar/tar.mk +++ b/package/tar/tar.mk @@ -14,6 +14,9 @@ TAR_LICENSE = GPL-3.0+ TAR_LICENSE_FILES = COPYING TAR_CPE_ID_VENDOR = gnu +# 0002-Fix-boundary-checking-in-base-256-decoder.patch +TAR_IGNORE_CVES += CVE-2022-48303 + ifeq ($(BR2_PACKAGE_ACL),y) TAR_DEPENDENCIES += acl TAR_CONF_OPTS += --with-posix-acls