Skip to content

Commit 8ed9a40

Browse files
Patched CVE-2024-2410 in mysql. (#10876)
Co-authored-by: jslobodzian <[email protected]>
1 parent 79add83 commit 8ed9a40

File tree

3 files changed

+236
-2
lines changed

3 files changed

+236
-2
lines changed

SPECS/mysql/CVE-2024-2410.patch

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
From b955165ebdcc5a8ba9c267230d6305f4e3d9c118 Mon Sep 17 00:00:00 2001
2+
From: Adam Cozzette <[email protected]>
3+
Date: Fri, 13 Oct 2023 15:20:54 -0700
4+
Subject: [PATCH] Internal change
5+
6+
PiperOrigin-RevId: 573332237
7+
---
8+
.../protobuf/io/test_zero_copy_stream.h | 22 ++++++++++++-------
9+
src/google/protobuf/json/BUILD.bazel | 1 +
10+
src/google/protobuf/json/internal/parser.cc | 2 +-
11+
src/google/protobuf/json/json_test.cc | 20 +++++++++++++++++
12+
4 files changed, 36 insertions(+), 9 deletions(-)
13+
14+
diff --git a/src/google/protobuf/io/test_zero_copy_stream.h b/src/google/protobuf/io/test_zero_copy_stream.h
15+
index 4c5a06db400e..1a56d7038c96 100644
16+
--- a/extra/protobuf/protobuf-24.4/src/google/protobuf/io/test_zero_copy_stream.h
17+
+++ b/extra/protobuf/protobuf-24.4/src/google/protobuf/io/test_zero_copy_stream.h
18+
@@ -9,12 +9,12 @@
19+
#define GOOGLE_PROTOBUF_IO_TEST_ZERO_COPY_STREAM_H__
20+
21+
#include <deque>
22+
+#include <memory>
23+
#include <string>
24+
#include <utility>
25+
#include <vector>
26+
27+
#include "absl/log/absl_check.h"
28+
-#include "absl/types/optional.h"
29+
#include "google/protobuf/io/zero_copy_stream.h"
30+
31+
// Must be included last.
32+
@@ -37,18 +37,22 @@ class TestZeroCopyInputStream final : public ZeroCopyInputStream {
33+
TestZeroCopyInputStream(const TestZeroCopyInputStream& other)
34+
: ZeroCopyInputStream(),
35+
buffers_(other.buffers_),
36+
- last_returned_buffer_(other.last_returned_buffer_),
37+
+ last_returned_buffer_(
38+
+ other.last_returned_buffer_
39+
+ ? std::make_unique<std::string>(*other.last_returned_buffer_)
40+
+ : nullptr),
41+
byte_count_(other.byte_count_) {}
42+
43+
bool Next(const void** data, int* size) override {
44+
ABSL_CHECK(data) << "data must not be null";
45+
ABSL_CHECK(size) << "size must not be null";
46+
- last_returned_buffer_ = absl::nullopt;
47+
+ last_returned_buffer_ = nullptr;
48+
49+
// We are done
50+
if (buffers_.empty()) return false;
51+
52+
- last_returned_buffer_ = std::move(buffers_.front());
53+
+ last_returned_buffer_ =
54+
+ std::make_unique<std::string>(std::move(buffers_.front()));
55+
buffers_.pop_front();
56+
*data = last_returned_buffer_->data();
57+
*size = static_cast<int>(last_returned_buffer_->size());
58+
@@ -58,19 +62,19 @@ class TestZeroCopyInputStream final : public ZeroCopyInputStream {
59+
60+
void BackUp(int count) override {
61+
ABSL_CHECK_GE(count, 0) << "count must not be negative";
62+
- ABSL_CHECK(last_returned_buffer_.has_value())
63+
+ ABSL_CHECK(last_returned_buffer_ != nullptr)
64+
<< "The last call was not a successful Next()";
65+
ABSL_CHECK_LE(count, last_returned_buffer_->size())
66+
<< "count must be within bounds of last buffer";
67+
buffers_.push_front(
68+
last_returned_buffer_->substr(last_returned_buffer_->size() - count));
69+
- last_returned_buffer_ = absl::nullopt;
70+
+ last_returned_buffer_ = nullptr;
71+
byte_count_ -= count;
72+
}
73+
74+
bool Skip(int count) override {
75+
ABSL_CHECK_GE(count, 0) << "count must not be negative";
76+
- last_returned_buffer_ = absl::nullopt;
77+
+ last_returned_buffer_ = nullptr;
78+
while (true) {
79+
if (count == 0) return true;
80+
if (buffers_.empty()) return false;
81+
@@ -96,7 +100,9 @@ class TestZeroCopyInputStream final : public ZeroCopyInputStream {
82+
// move them to `last_returned_buffer_`. It makes it simpler to keep track of
83+
// the state of the object. The extra cost is not relevant for testing.
84+
std::deque<std::string> buffers_;
85+
- absl::optional<std::string> last_returned_buffer_;
86+
+ // absl::optional could work here, but std::unique_ptr makes it more likely
87+
+ // for sanitizers to detect if the string is used after it is destroyed.
88+
+ std::unique_ptr<std::string> last_returned_buffer_;
89+
int64_t byte_count_ = 0;
90+
};
91+
92+
diff --git a/src/google/protobuf/json/BUILD.bazel b/src/google/protobuf/json/BUILD.bazel
93+
index dece74e4d0f0..6ec8184e0e09 100644
94+
--- a/extra/protobuf/protobuf-24.4/src/google/protobuf/json/BUILD.bazel
95+
+++ b/extra/protobuf/protobuf-24.4/src/google/protobuf/json/BUILD.bazel
96+
@@ -41,6 +41,7 @@ cc_test(
97+
"//src/google/protobuf:cc_test_protos",
98+
"//src/google/protobuf:port_def",
99+
"//src/google/protobuf/io",
100+
+ "//src/google/protobuf/io:test_zero_copy_stream",
101+
"//src/google/protobuf/util:json_format_cc_proto",
102+
"//src/google/protobuf/util:json_format_proto3_cc_proto",
103+
"//src/google/protobuf/util:type_resolver_util",
104+
diff --git a/src/google/protobuf/json/internal/parser.cc b/src/google/protobuf/json/internal/parser.cc
105+
index 17e8fcc07c42..fbf492afa715 100644
106+
--- a/extra/protobuf/protobuf-24.4/src/google/protobuf/json/internal/parser.cc
107+
+++ b/extra/protobuf/protobuf-24.4/src/google/protobuf/json/internal/parser.cc
108+
@@ -1273,7 +1273,7 @@ absl::Status ParseMessage(JsonLexer& lex, const Desc<Traits>& desc,
109+
}
110+
}
111+
112+
- return ParseField<Traits>(lex, desc, name.value.AsView(), msg);
113+
+ return ParseField<Traits>(lex, desc, name.value.ToString(), msg);
114+
});
115+
}
116+
} // namespace
117+
diff --git a/src/google/protobuf/json/json_test.cc b/src/google/protobuf/json/json_test.cc
118+
index 48379ceeb5f9..2ff1e87a90fe 100644
119+
--- a/extra/protobuf/protobuf-24.4/src/google/protobuf/json/json_test.cc
120+
+++ b/extra/protobuf/protobuf-24.4/src/google/protobuf/json/json_test.cc
121+
@@ -26,6 +26,7 @@
122+
#include "absl/strings/string_view.h"
123+
#include "google/protobuf/descriptor_database.h"
124+
#include "google/protobuf/dynamic_message.h"
125+
+#include "google/protobuf/io/test_zero_copy_stream.h"
126+
#include "google/protobuf/io/zero_copy_stream.h"
127+
#include "google/protobuf/io/zero_copy_stream_impl_lite.h"
128+
#include "google/protobuf/util/json_format.pb.h"
129+
@@ -50,6 +51,7 @@ using ::proto3::TestMap;
130+
using ::proto3::TestMessage;
131+
using ::proto3::TestOneof;
132+
using ::proto3::TestWrapper;
133+
+using ::testing::ContainsRegex;
134+
using ::testing::ElementsAre;
135+
using ::testing::IsEmpty;
136+
using ::testing::Not;
137+
@@ -1331,6 +1333,24 @@ TEST_P(JsonTest, ClearPreExistingRepeatedInJsonValues) {
138+
EXPECT_THAT(s.fields(), IsEmpty());
139+
}
140+
141+
+TEST(JsonErrorTest, FieldNameAndSyntaxErrorInSeparateChunks) {
142+
+ std::unique_ptr<TypeResolver> resolver{
143+
+ google::protobuf::util::NewTypeResolverForDescriptorPool(
144+
+ "type.googleapis.com", DescriptorPool::generated_pool())};
145+
+ io::internal::TestZeroCopyInputStream input_stream(
146+
+ {"{\"bool_value\":", "5}"});
147+
+ std::string result;
148+
+ io::StringOutputStream output_stream(&result);
149+
+ absl::Status s = JsonToBinaryStream(
150+
+ resolver.get(), "type.googleapis.com/proto3.TestMessage", &input_stream,
151+
+ &output_stream, ParseOptions{});
152+
+ ASSERT_FALSE(s.ok());
153+
+ EXPECT_THAT(
154+
+ s.message(),
155+
+ ContainsRegex("invalid *JSON *in *type.googleapis.com/proto3.TestMessage "
156+
+ "*@ *bool_value"));
157+
+}
158+
+
159+
} // namespace
160+
} // namespace json
161+
} // namespace protobuf
162+
Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
From 540814076995de6bcb119a68fa4cce9e7214b3c0 Mon Sep 17 00:00:00 2001
2+
From: Pawel Winogrodzki <[email protected]>
3+
Date: Tue, 29 Oct 2024 15:37:51 -0700
4+
Subject: [PATCH] Remove ciphers unsupported by AZL.
5+
6+
---
7+
.../src/harness/tests/test_tls_server_context.cc | 15 ++++++++-------
8+
1 file changed, 8 insertions(+), 7 deletions(-)
9+
10+
diff --git a/router/src/harness/tests/test_tls_server_context.cc b/router/src/harness/tests/test_tls_server_context.cc
11+
index 57859357..e7edb4fa 100644
12+
--- a/router/src/harness/tests/test_tls_server_context.cc
13+
+++ b/router/src/harness/tests/test_tls_server_context.cc
14+
@@ -93,7 +93,6 @@ static const std::string acceptable_ciphers_test_data[] = {
15+
// TLSv1.3
16+
{"TLS_AES_128_GCM_SHA256"},
17+
{"TLS_AES_256_GCM_SHA384"},
18+
- {"TLS_CHACHA20_POLY1305_SHA256"},
19+
#if 0 // embedded
20+
{"TLS_AES_128_CCM_SHA256"},
21+
#endif
22+
@@ -102,11 +101,6 @@ static const std::string acceptable_ciphers_test_data[] = {
23+
{"ECDHE-RSA-AES256-GCM-SHA384"},
24+
{"DHE-RSA-AES128-GCM-SHA256"},
25+
{"DHE-RSA-AES256-GCM-SHA384"},
26+
-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0)
27+
- {"ECDHE-ECDSA-CHACHA20-POLY1305"},
28+
- {"ECDHE-RSA-CHACHA20-POLY1305"},
29+
- {"DHE-RSA-CHACHA20-POLY1305"},
30+
-#endif
31+
#if 0 // embedded
32+
{"ECDHE-ECDSA-AES256-CCM"},
33+
{"ECDHE-ECDSA-AES128-CCM"},
34+
@@ -336,7 +330,14 @@ static const std::string unacceptable_ciphers_test_data[] = {
35+
{"ECDH-ECDSA-DES-CBC3-SHA"},
36+
{"ECDHE-RSA-DES-CBC3-SHA"},
37+
{"ECDHE-ECDSA-DES-CBC3-SHA"},
38+
- {"DES-CBC3-SHA"},
39+
+#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1)
40+
+ {"TLS_CHACHA20_POLY1305_SHA256"},
41+
+#endif
42+
+#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0)
43+
+ {"ECDHE-ECDSA-CHACHA20-POLY1305"},
44+
+ {"ECDHE-RSA-CHACHA20-POLY1305"},
45+
+ {"DHE-RSA-CHACHA20-POLY1305"},
46+
+#endif
47+
};
48+
49+
INSTANTIATE_TEST_SUITE_P(CiphersUnacceptableParam, CiphersUnacceptable,
50+
--
51+
2.34.1
52+

SPECS/mysql/mysql.spec

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,30 @@
11
Summary: MySQL.
22
Name: mysql
33
Version: 8.0.40
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv2 with exceptions AND LGPLv2 AND BSD
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: Applications/Databases
99
URL: https://www.mysql.com
1010
Source0: https://dev.mysql.com/get/Downloads/MySQL-8.0/%{name}-boost-%{version}.tar.gz
1111
Patch0: CVE-2012-5627.nopatch
12+
# Patch can be removed after upgrading MySQL to 8.4+
13+
# or switching to system Protobuf 3.25+ with the 'WITH_PROTOBUF=system' option.
14+
Patch1: CVE-2024-2410.patch
15+
# AZL's OpenSSL builds with the "no-chacha" option making all ChaCha
16+
# ciphers unavailable.
17+
Patch2: fix-tests-for-unsupported-chacha-ciphers.patch
1218
BuildRequires: cmake
1319
BuildRequires: libtirpc-devel
1420
BuildRequires: openssl-devel
1521
BuildRequires: rpcsvc-proto-devel
1622
BuildRequires: zlib-devel
23+
%if 0%{?with_check}
24+
BuildRequires: shadow-utils
25+
BuildRequires: sudo
26+
%endif
27+
1728
Requires(postun): shadow-utils
1829
Requires(pre): shadow-utils
1930

@@ -50,7 +61,13 @@ make %{?_smp_mflags}
5061
make DESTDIR=%{buildroot} install
5162

5263
%check
53-
make test
64+
# Tests expect to be run as a non-root user.
65+
groupadd test
66+
useradd test -g test -m
67+
chown -R test:test .
68+
69+
# In case of failure, print the test log.
70+
sudo -u test make test || { cat Testing/Temporary/LastTest.log; false; }
5471

5572
%pre
5673
getent group mysql >/dev/null || groupadd -r mysql
@@ -97,6 +114,9 @@ fi
97114
%{_libdir}/pkgconfig/mysqlclient.pc
98115

99116
%changelog
117+
* Tue Oct 29 2024 Pawel Winogrodzki <[email protected]> - 8.0.40-2
118+
- Patched CVE-2024-2410.
119+
100120
* Fri Oct 18 2024 Sudipta Pandit <[email protected]> - 8.0.40-1
101121
- Upgrade to 8.0.40 to fix multiple CVEs -- CVE-2024-21193, CVE-2024-21194, CVE-2024-21162, CVE-2024-21157, CVE-2024-21130,
102122
CVE-2024-20996, CVE-2024-21129, CVE-2024-21159, CVE-2024-21135, CVE-2024-21173, CVE-2024-21160, CVE-2024-21125, CVE-2024-21134,

0 commit comments

Comments
 (0)