Skip to content

Commit fdaaaeb

Browse files
durgajagadeeshdurgajagadeesh
authored
1 parent 6966b07 commit fdaaaeb

File tree

6 files changed

+285
-8
lines changed

6 files changed

+285
-8
lines changed

‎SPECS/cmake/CVE-2025-5916.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From cb083a8451e8bb463512d7cd18d4698bf27c6fcf Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Thu, 19 Jun 2025 12:55:15 +0000
4+
Subject: [PATCH] Address CVE-2025-5916
5+
6+
Upstream patch reference:https://github.com/libarchive/libarchive/pull/2568
7+
8+
---
9+
Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c | 7 +++++--
10+
1 file changed, 5 insertions(+), 2 deletions(-)
11+
12+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c b/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
13+
index 72977b8e..0f3ee8d1 100644
14+
--- a/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
15+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
16+
@@ -363,7 +363,8 @@ start_over:
17+
/* FALLTHROUGH */
18+
default:
19+
/* consume the content and start over */
20+
- _warc_skip(a);
21+
+ if (_warc_skip(a) < 0)
22+
+ return (ARCHIVE_FATAL);
23+
goto start_over;
24+
}
25+
return (ARCHIVE_OK);
26+
@@ -416,7 +417,9 @@ _warc_skip(struct archive_read *a)
27+
{
28+
struct warc_s *w = a->format->data;
29+
30+
- __archive_read_consume(a, w->cntlen + 4U/*\r\n\r\n separator*/);
31+
+ if (__archive_read_consume(a, w->cntlen) < 0 ||
32+
+ __archive_read_consume(a, 4U/*\r\n\r\n separator*/) < 0)
33+
+ return (ARCHIVE_FATAL);
34+
w->cntlen = 0U;
35+
w->cntoff = 0U;
36+
return (ARCHIVE_OK);
37+
--
38+
2.45.2
39+

‎SPECS/cmake/CVE-2025-5917.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From b211326905f20a8c9611911ebfef8a40c84757eb Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Thu, 19 Jun 2025 13:36:28 +0000
4+
Subject: [PATCH] Address CVE-2025-5917
5+
6+
Upstream patch reference:https://github.com/libarchive/libarchive/pull/2588
7+
8+
---
9+
Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c | 4 ++--
10+
1 file changed, 2 insertions(+), 2 deletions(-)
11+
12+
diff --git a/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c b/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
13+
index a2b27107..0e0c71eb 100644
14+
--- a/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
15+
+++ b/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
16+
@@ -1542,7 +1542,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
17+
const char *filename, *filename_end;
18+
char *p;
19+
int need_slash = 0; /* Was there a trailing slash? */
20+
- size_t suffix_length = 99;
21+
+ size_t suffix_length = 98; /* 99 - 1 for trailing slash */
22+
size_t insert_length;
23+
24+
/* Length of additional dir element to be added. */
25+
@@ -1594,7 +1594,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
26+
/* Step 2: Locate the "prefix" section of the dirname, including
27+
* trailing '/'. */
28+
prefix = src;
29+
- prefix_end = prefix + 155;
30+
+ prefix_end = prefix + 154 /* 155 - 1 for trailing / */;
31+
if (prefix_end > filename)
32+
prefix_end = filename;
33+
while (prefix_end > prefix && *prefix_end != '/')
34+
--
35+
2.45.2
36+

‎SPECS/cmake/CVE-2025-5918.patch‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
From 8a0cc2ca12fc939ac7390776ae12de627372650d Mon Sep 17 00:00:00 2001
2+
From: Durga Jagadeesh Palli <[email protected]>
3+
Date: Tue, 9 Sep 2025 00:32:16 +0000
4+
Subject: [PATCH] Address CVE-2025-5918 and fix the FILE skip regression.
5+
6+
Upstream Patch Reference: https://github.com/libarchive/libarchive/pull/2584
7+
Upstream Patch Reference for fix FILE_skip regression: https://github.com/libarchive/libarchive/pull/2642
8+
9+
---
10+
Utilities/cmlibarchive/libarchive/archive_read_open_fd.c | 13 +++++--
11+
Utilities/cmlibarchive/libarchive/archive_read_open_file.c | 36 ++++++++++++++-----
12+
Utilities/cmlibarchive/libarchive/archive_read_open_filename.c | 30 ++++++++++++----
13+
3 files changed, 62 insertions(+), 17 deletions(-)
14+
15+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c b/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
16+
index f59cd07f..f8c5d0a1 100644
17+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
18+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
19+
@@ -53,6 +53,7 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_read_open_fd.c 201103 2009-12-28
20+
struct read_fd_data {
21+
int fd;
22+
size_t block_size;
23+
+ int64_t size;
24+
char use_lseek;
25+
void *buffer;
26+
};
27+
@@ -96,6 +97,7 @@ archive_read_open_fd(struct archive *a, int fd, size_t block_size)
28+
if (S_ISREG(st.st_mode)) {
29+
archive_read_extract_set_skip_file(a, st.st_dev, st.st_ino);
30+
mine->use_lseek = 1;
31+
+ mine->size = st.st_size;
32+
}
33+
#if defined(__CYGWIN__) || defined(_WIN32)
34+
setmode(mine->fd, O_BINARY);
35+
@@ -152,9 +154,14 @@ file_skip(struct archive *a, void *client_data, int64_t request)
36+
if (request == 0)
37+
return (0);
38+
39+
- if (((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) &&
40+
- ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0))
41+
- return (new_offset - old_offset);
42+
+ if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) {
43+
+ if (old_offset >= mine->size ||
44+
+ skip > mine->size - old_offset) {
45+
+ /* Do not seek past end of file. */
46+
+ errno = ESPIPE;
47+
+ } else if ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0)
48+
+ return (new_offset - old_offset);
49+
+ }
50+
51+
/* If seek failed once, it will probably fail again. */
52+
mine->use_lseek = 0;
53+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_file.c b/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
54+
index 101dae6c..de77e74f 100644
55+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
56+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
57+
@@ -53,6 +53,7 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_read_open_file.c 201093 2009-12-
58+
struct read_FILE_data {
59+
FILE *f;
60+
size_t block_size;
61+
+ int64_t size;
62+
void *buffer;
63+
char can_skip;
64+
};
65+
@@ -91,6 +92,7 @@ archive_read_open_FILE(struct archive *a, FILE *f)
66+
archive_read_extract_set_skip_file(a, st.st_dev, st.st_ino);
67+
/* Enable the seek optimization only for regular files. */
68+
mine->can_skip = 1;
69+
+ mine->size = st.st_size;
70+
} else
71+
mine->can_skip = 0;
72+
73+
@@ -130,6 +132,7 @@ file_skip(struct archive *a, void *client_data, int64_t request)
74+
#else
75+
long skip = (long)request;
76+
#endif
77+
+ int64_t old_offset, new_offset = -1;
78+
int skip_bits = sizeof(skip) * 8 - 1;
79+
80+
(void)a; /* UNUSED */
81+
@@ -153,19 +156,36 @@ file_skip(struct archive *a, void *client_data, int64_t request)
82+
83+
#ifdef __ANDROID__
84+
/* fileno() isn't safe on all platforms ... see above. */
85+
- if (lseek(fileno(mine->f), skip, SEEK_CUR) < 0)
86+
+ old_offset = lseek(fileno(mine->f), 0, SEEK_CUR);
87+
#elif HAVE_FSEEKO
88+
- if (fseeko(mine->f, skip, SEEK_CUR) != 0)
89+
+ old_offset = ftello(mine->f);
90+
#elif HAVE__FSEEKI64
91+
- if (_fseeki64(mine->f, skip, SEEK_CUR) != 0)
92+
+ old_offset = _ftelli64(mine->f);
93+
#else
94+
- if (fseek(mine->f, skip, SEEK_CUR) != 0)
95+
+ old_offset = ftell(mine->f);
96+
#endif
97+
- {
98+
- mine->can_skip = 0;
99+
- return (0);
100+
+ if (old_offset >= 0) {
101+
+ if (old_offset < mine->size &&
102+
+ skip <= mine->size - old_offset) {
103+
+#ifdef __ANDROID__
104+
+ new_offset = lseek(fileno(mine->f), skip, SEEK_CUR);
105+
+#elif HAVE__FSEEKI64
106+
+ if (_fseeki64(mine->f, skip, SEEK_CUR) == 0)
107+
+ new_offset = _ftelli64(mine->f);
108+
+#elif HAVE_FSEEKO
109+
+ if (fseeko(mine->f, skip, SEEK_CUR) == 0)
110+
+ new_offset = ftello(mine->f);
111+
+#else
112+
+ if (fseek(mine->f, skip, SEEK_CUR) == 0)
113+
+ new_offset = ftell(mine->f);
114+
+#endif
115+
+ if (new_offset >= 0)
116+
+ return (new_offset - old_offset);
117+
+ }
118+
}
119+
- return (request);
120+
+
121+
+ mine->can_skip = 0;
122+
+ return (0);
123+
}
124+
125+
static int
126+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c b/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
127+
index 86635e21..84556a15 100644
128+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
129+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
130+
@@ -75,6 +75,7 @@ struct read_file_data {
131+
size_t block_size;
132+
void *buffer;
133+
mode_t st_mode; /* Mode bits for opened file. */
134+
+ int64_t size;
135+
char use_lseek;
136+
enum fnt_e { FNT_STDIN, FNT_MBS, FNT_WCS } filename_type;
137+
union {
138+
@@ -366,8 +367,10 @@ file_open(struct archive *a, void *client_data)
139+
mine->st_mode = st.st_mode;
140+
141+
/* Disk-like inputs can use lseek(). */
142+
- if (is_disk_like)
143+
+ if (is_disk_like) {
144+
mine->use_lseek = 1;
145+
+ mine->size = st.st_size;
146+
+ }
147+
148+
return (ARCHIVE_OK);
149+
fail:
150+
@@ -445,21 +448,36 @@ file_skip_lseek(struct archive *a, void *client_data, int64_t request)
151+
struct read_file_data *mine = (struct read_file_data *)client_data;
152+
#if defined(_WIN32) && !defined(__CYGWIN__)
153+
/* We use _lseeki64() on Windows. */
154+
- int64_t old_offset, new_offset;
155+
+ int64_t old_offset, new_offset, skip = request;;
156+
#else
157+
- off_t old_offset, new_offset;
158+
+ off_t old_offset, new_offset, skip = (off_t)request;
159+
#endif
160+
+ int skip_bits = sizeof(skip) * 8 - 1;
161+
162+
/* We use off_t here because lseek() is declared that way. */
163+
164+
+ /* Reduce a request that would overflow the 'skip' variable. */
165+
+ if (sizeof(request) > sizeof(skip)) {
166+
+ const int64_t max_skip =
167+
+ (((int64_t)1 << (skip_bits - 1)) - 1) * 2 + 1;
168+
+ if (request > max_skip)
169+
+ skip = max_skip;
170+
+ }
171+
+
172+
/* TODO: Deal with case where off_t isn't 64 bits.
173+
* This shouldn't be a problem on Linux or other POSIX
174+
* systems, since the configuration logic for libarchive
175+
* tries to obtain a 64-bit off_t.
176+
*/
177+
- if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0 &&
178+
- (new_offset = lseek(mine->fd, request, SEEK_CUR)) >= 0)
179+
- return (new_offset - old_offset);
180+
+
181+
+ if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) {
182+
+ if (old_offset >= mine->size ||
183+
+ skip > mine->size - old_offset) {
184+
+ /* Do not seek past end of file. */
185+
+ errno = ESPIPE;
186+
+ } else if ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0)
187+
+ return (new_offset - old_offset);
188+
+ }
189+
190+
/* If lseek() fails, don't bother trying again. */
191+
mine->use_lseek = 0;
192+
--
193+
2.45.4
194+

‎SPECS/cmake/cmake.spec‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 19%{?dist}
5+
Release: 20%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -34,9 +34,13 @@ Patch19: CVE-2024-28182.patch
3434
Patch20: CVE-2024-7264.patch
3535
Patch21: CVE-2024-11053.patch
3636
Patch22: CVE-2024-9681.patch
37-
Patch23: CVE-2024-48615.patch
38-
Patch24: CVE-2024-8096.patch
39-
Patch25: CVE-2025-9301.patch
37+
Patch23: CVE-2024-48615.patch
38+
Patch24: CVE-2024-8096.patch
39+
Patch25: CVE-2025-9301.patch
40+
Patch26: CVE-2025-5916.patch
41+
Patch27: CVE-2025-5917.patch
42+
Patch28: CVE-2025-5918.patch
43+
4044
BuildRequires: bzip2
4145
BuildRequires: bzip2-devel
4246
BuildRequires: curl
@@ -102,6 +106,10 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
102106
%{_prefix}/doc/%{name}-*/*
103107

104108
%changelog
109+
* Wed Sep 24 2025 Durga Jagadeesh Palli <[email protected]> - 3.21.4-20
110+
- Patch CVE-2025-5916, CVE-2025-5917 & CVE-2025-5918
111+
- Fix FILE skip regression in CVE-2025-5918 patch.
112+
105113
* Fri Aug 22 2025 Azure Linux Security Servicing Account <[email protected]> - 3.21.4-19
106114
- Patch for CVE-2025-9301
107115

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-19.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-19.cm2.aarch64.rpm
33+
cmake-3.21.4-20.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-20.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-19.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-19.cm2.x86_64.rpm
34+
cmake-3.21.4-20.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-20.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)