Skip to content

Commit 56d2f88

Browse files
durgajagadeeshdurgajagadeesh
authored
[Low] Patch cmake for CVE-2025-5916, CVE-2025-5917 & CVE-2025-5918 (#14085)
1 parent 8efb1a3 commit 56d2f88

File tree

6 files changed

+275
-5
lines changed

6 files changed

+275
-5
lines changed

‎SPECS/cmake/CVE-2025-5916.patch

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From 849da096e8170a70652c191d6e22ca00b05f8d94 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Mon, 23 Jun 2025 20:41:17 +0000
4+
Subject: [PATCH] Address CVE-2025-5916
5+
6+
Upstream patch reference: https://github.com/libarchive/libarchive/pull/2568
7+
8+
---
9+
.../libarchive/archive_read_support_format_warc.c | 7 +++++--
10+
1 file changed, 5 insertions(+), 2 deletions(-)
11+
12+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c b/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
13+
index 61ab29ea..d955af95 100644
14+
--- a/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
15+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_support_format_warc.c
16+
@@ -379,7 +379,8 @@ start_over:
17+
case LAST_WT:
18+
default:
19+
/* consume the content and start over */
20+
- _warc_skip(a);
21+
+ if (_warc_skip(a) < 0)
22+
+ return (ARCHIVE_FATAL);
23+
goto start_over;
24+
}
25+
return (ARCHIVE_OK);
26+
@@ -432,7 +433,9 @@ _warc_skip(struct archive_read *a)
27+
{
28+
struct warc_s *w = a->format->data;
29+
30+
- __archive_read_consume(a, w->cntlen + 4U/*\r\n\r\n separator*/);
31+
+ if (__archive_read_consume(a, w->cntlen) < 0 ||
32+
+ __archive_read_consume(a, 4U/*\r\n\r\n separator*/) < 0)
33+
+ return (ARCHIVE_FATAL);
34+
w->cntlen = 0U;
35+
w->cntoff = 0U;
36+
return (ARCHIVE_OK);
37+
--
38+
2.45.2
39+

‎SPECS/cmake/CVE-2025-5917.patch

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
From e055a3a5392d95ea781cadb7613d51d355df8597 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Mon, 23 Jun 2025 20:45:00 +0000
4+
Subject: [PATCH] Address CVE-2025-5917
5+
6+
Upstream patch reference: https://github.com/libarchive/libarchive/pull/2588
7+
---
8+
.../cmlibarchive/libarchive/archive_write_set_format_pax.c | 4 ++--
9+
1 file changed, 2 insertions(+), 2 deletions(-)
10+
11+
diff --git a/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c b/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
12+
index 1eb9a9a4..4a931f96 100644
13+
--- a/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
14+
+++ b/Utilities/cmlibarchive/libarchive/archive_write_set_format_pax.c
15+
@@ -1556,7 +1556,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
16+
const char *filename, *filename_end;
17+
char *p;
18+
int need_slash = 0; /* Was there a trailing slash? */
19+
- size_t suffix_length = 99;
20+
+ size_t suffix_length = 98; /* 99 - 1 for trailing slash */
21+
size_t insert_length;
22+
23+
/* Length of additional dir element to be added. */
24+
@@ -1608,7 +1608,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
25+
/* Step 2: Locate the "prefix" section of the dirname, including
26+
* trailing '/'. */
27+
prefix = src;
28+
- prefix_end = prefix + 155;
29+
+ prefix_end = prefix + 154 /* 155 - 1 for trailing / */;
30+
if (prefix_end > filename)
31+
prefix_end = filename;
32+
while (prefix_end > prefix && *prefix_end != '/')
33+
--
34+
2.45.2
35+

‎SPECS/cmake/CVE-2025-5918.patch

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
From f4b4b476a8ade08201ce9dda57445ca1e6b6921d Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Tue, 8 Jul 2025 13:11:24 +0000
4+
Subject: [PATCH] Address CVE-2025-5918
5+
6+
Upstream patch reference: https://github.com/libarchive/libarchive/pull/2584
7+
8+
---
9+
.../libarchive/archive_read_open_fd.c | 13 ++++++--
10+
.../libarchive/archive_read_open_file.c | 33 ++++++++++++++-----
11+
.../libarchive/archive_read_open_filename.c | 29 ++++++++++++----
12+
3 files changed, 58 insertions(+), 17 deletions(-)
13+
14+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c b/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
15+
index f59cd07f..2c4dfa35 100644
16+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
17+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_fd.c
18+
@@ -53,6 +53,7 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_read_open_fd.c 201103 2009-12-28
19+
struct read_fd_data {
20+
int fd;
21+
size_t block_size;
22+
+ int64_t size;
23+
char use_lseek;
24+
void *buffer;
25+
};
26+
@@ -96,6 +97,7 @@ archive_read_open_fd(struct archive *a, int fd, size_t block_size)
27+
if (S_ISREG(st.st_mode)) {
28+
archive_read_extract_set_skip_file(a, st.st_dev, st.st_ino);
29+
mine->use_lseek = 1;
30+
+ mine->size = st.st_size;
31+
}
32+
#if defined(__CYGWIN__) || defined(_WIN32)
33+
setmode(mine->fd, O_BINARY);
34+
@@ -152,9 +154,14 @@ file_skip(struct archive *a, void *client_data, int64_t request)
35+
if (request == 0)
36+
return (0);
37+
38+
- if (((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) &&
39+
- ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0))
40+
- return (new_offset - old_offset);
41+
+ if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) {
42+
+ if (old_offset >= mine->size ||
43+
+ skip > mine->size - old_offset) {
44+
+ /* Do not seek past end of file. */
45+
+ errno = ESPIPE;
46+
+ } else if ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0)
47+
+ return (new_offset - old_offset);
48+
+ }
49+
50+
/* If seek failed once, it will probably fail again. */
51+
mine->use_lseek = 0;
52+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_file.c b/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
53+
index 03719e8b..3dc5d319 100644
54+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
55+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_file.c
56+
@@ -53,6 +53,7 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_read_open_file.c 201093 2009-12-
57+
struct read_FILE_data {
58+
FILE *f;
59+
size_t block_size;
60+
+ int64_t size;
61+
void *buffer;
62+
char can_skip;
63+
};
64+
@@ -91,6 +92,7 @@ archive_read_open_FILE(struct archive *a, FILE *f)
65+
archive_read_extract_set_skip_file(a, st.st_dev, st.st_ino);
66+
/* Enable the seek optimization only for regular files. */
67+
mine->can_skip = 1;
68+
+ mine->size = st.st_size;
69+
} else
70+
mine->can_skip = 0;
71+
72+
@@ -130,6 +132,7 @@ file_skip(struct archive *a, void *client_data, int64_t request)
73+
#else
74+
long skip = (long)request;
75+
#endif
76+
+ int64_t old_offset, new_offset;
77+
int skip_bits = sizeof(skip) * 8 - 1;
78+
79+
(void)a; /* UNUSED */
80+
@@ -153,19 +156,33 @@ file_skip(struct archive *a, void *client_data, int64_t request)
81+
82+
#ifdef __ANDROID__
83+
/* fileno() isn't safe on all platforms ... see above. */
84+
- if (lseek(fileno(mine->f), skip, SEEK_CUR) < 0)
85+
+ old_offset = lseek(fileno(mine->f), 0, SEEK_CUR);
86+
#elif HAVE__FSEEKI64
87+
- if (_fseeki64(mine->f, skip, SEEK_CUR) != 0)
88+
+ old_offset = _ftelli64(mine->f);
89+
#elif HAVE_FSEEKO
90+
- if (fseeko(mine->f, skip, SEEK_CUR) != 0)
91+
+ old_offset = ftello(mine->f);
92+
#else
93+
- if (fseek(mine->f, skip, SEEK_CUR) != 0)
94+
+ old_offset = ftell(mine->f);
95+
#endif
96+
- {
97+
- mine->can_skip = 0;
98+
- return (0);
99+
+ if (old_offset >= 0) {
100+
+ if (old_offset < mine->size &&
101+
+ skip <= mine->size - old_offset) {
102+
+#ifdef __ANDROID__
103+
+ new_offset = lseek(fileno(mine->f), skip, SEEK_CUR);
104+
+#elif HAVE__FSEEKI64
105+
+ new_offset = _fseeki64(mine->f, skip, SEEK_CUR);
106+
+#elif HAVE_FSEEKO
107+
+ new_offset = fseeko(mine->f, skip, SEEK_CUR);
108+
+#else
109+
+ new_offset = fseek(mine->f, skip, SEEK_CUR);
110+
+#endif
111+
+ if (new_offset >= 0)
112+
+ return (new_offset - old_offset);
113+
+ }
114+
}
115+
- return (request);
116+
+
117+
+ mine->can_skip = 0;
118+
+ return (0);
119+
}
120+
121+
static int
122+
diff --git a/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c b/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
123+
index 561289b6..20b57464 100644
124+
--- a/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
125+
+++ b/Utilities/cmlibarchive/libarchive/archive_read_open_filename.c
126+
@@ -75,6 +75,7 @@ struct read_file_data {
127+
size_t block_size;
128+
void *buffer;
129+
mode_t st_mode; /* Mode bits for opened file. */
130+
+ int64_t size;
131+
char use_lseek;
132+
enum fnt_e { FNT_STDIN, FNT_MBS, FNT_WCS } filename_type;
133+
union {
134+
@@ -370,8 +371,10 @@ file_open(struct archive *a, void *client_data)
135+
mine->st_mode = st.st_mode;
136+
137+
/* Disk-like inputs can use lseek(). */
138+
- if (is_disk_like)
139+
+ if (is_disk_like) {
140+
mine->use_lseek = 1;
141+
+ mine->size = st.st_size;
142+
+ }
143+
144+
return (ARCHIVE_OK);
145+
fail:
146+
@@ -449,21 +452,35 @@ file_skip_lseek(struct archive *a, void *client_data, int64_t request)
147+
struct read_file_data *mine = (struct read_file_data *)client_data;
148+
#if defined(_WIN32) && !defined(__CYGWIN__)
149+
/* We use _lseeki64() on Windows. */
150+
- int64_t old_offset, new_offset;
151+
+ int64_t old_offset, new_offset, skip = request;
152+
#else
153+
- off_t old_offset, new_offset;
154+
+ off_t old_offset, new_offset, skip = (off_t)request;
155+
#endif
156+
+ int skip_bits = sizeof(skip) * 8 - 1;
157+
158+
/* We use off_t here because lseek() is declared that way. */
159+
160+
+ /* Reduce a request that would overflow the 'skip' variable. */
161+
+ if (sizeof(request) > sizeof(skip)) {
162+
+ const int64_t max_skip =
163+
+ (((int64_t)1 << (skip_bits - 1)) - 1) * 2 + 1;
164+
+ if (request > max_skip)
165+
+ skip = max_skip;
166+
+ }
167+
+
168+
/* TODO: Deal with case where off_t isn't 64 bits.
169+
* This shouldn't be a problem on Linux or other POSIX
170+
* systems, since the configuration logic for libarchive
171+
* tries to obtain a 64-bit off_t.
172+
*/
173+
- if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0 &&
174+
- (new_offset = lseek(mine->fd, request, SEEK_CUR)) >= 0)
175+
- return (new_offset - old_offset);
176+
+ if ((old_offset = lseek(mine->fd, 0, SEEK_CUR)) >= 0) {
177+
+ if (old_offset >= mine->size ||
178+
+ skip > mine->size - old_offset) {
179+
+ /* Do not seek past end of file. */
180+
+ errno = ESPIPE;
181+
+ } else if ((new_offset = lseek(mine->fd, skip, SEEK_CUR)) >= 0)
182+
+ return (new_offset - old_offset);
183+
+ }
184+
185+
/* If lseek() fails, don't bother trying again. */
186+
mine->use_lseek = 0;
187+
--
188+
2.45.2
189+

‎SPECS/cmake/cmake.spec

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.30.3
5-
Release: 7%{?dist}
5+
Release: 8%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -27,6 +27,10 @@ Patch7: CVE-2023-44487.patch
2727
Patch8: CVE-2023-35945.patch
2828
Patch9: CVE-2024-48615.patch
2929
Patch10: CVE-2025-4947.patch
30+
Patch11: CVE-2025-5916.patch
31+
Patch12: CVE-2025-5917.patch
32+
Patch13: CVE-2025-5918.patch
33+
3034
BuildRequires: bzip2
3135
BuildRequires: bzip2-devel
3236
BuildRequires: curl
@@ -106,6 +110,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
106110
%{_libdir}/rpm/macros.d/macros.cmake
107111

108112
%changelog
113+
* Tue Jun 24 2025 Durga Jagadeesh Palli <[email protected]> - 3.30.3-8
114+
- Patch CVE-2025-5916, CVE-2025-5917 & CVE-2025-5918
115+
109116
* Tue Jun 03 2025 Durga Jagadeesh Palli <[email protected]> - 3.30.3-7
110117
- Patch CVE-2025-4947
111118

‎toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
5151
chkconfig-1.25-1.azl3.aarch64.rpm
5252
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
5353
chkconfig-lang-1.25-1.azl3.aarch64.rpm
54-
cmake-3.30.3-7.azl3.aarch64.rpm
55-
cmake-debuginfo-3.30.3-7.azl3.aarch64.rpm
54+
cmake-3.30.3-8.azl3.aarch64.rpm
55+
cmake-debuginfo-3.30.3-8.azl3.aarch64.rpm
5656
coreutils-9.4-6.azl3.aarch64.rpm
5757
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
5858
coreutils-lang-9.4-6.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
5454
chkconfig-1.25-1.azl3.x86_64.rpm
5555
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
5656
chkconfig-lang-1.25-1.azl3.x86_64.rpm
57-
cmake-3.30.3-7.azl3.x86_64.rpm
58-
cmake-debuginfo-3.30.3-7.azl3.x86_64.rpm
57+
cmake-3.30.3-8.azl3.x86_64.rpm
58+
cmake-debuginfo-3.30.3-8.azl3.x86_64.rpm
5959
coreutils-9.4-6.azl3.x86_64.rpm
6060
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
6161
coreutils-lang-9.4-6.azl3.x86_64.rpm

0 commit comments

Comments
 (0)