Skip to content

Commit f426b7a

Browse files
CBL-Mariner-Botjykanase
CBL-Mariner-Bot
and
jykanase
authored
[AUTO-CHERRYPICK] [Medium] cmake: Fix CVE-2024-7264 and CVE-2024-9681 - branch 3.0-dev (#12120)
Co-authored-by: jykanase <[email protected]>
1 parent 16cb2ad commit f426b7a

File tree

5 files changed

+196
-5
lines changed

5 files changed

+196
-5
lines changed

‎SPECS/cmake/CVE-2024-7264.patch

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
From e09204d779434ff6ed01532ee8c04c44018b8abe Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Mon, 27 Jan 2025 05:08:31 +0000
4+
Subject: [PATCH] CVE-2024-7264
5+
6+
---
7+
Utilities/cmcurl/lib/vtls/x509asn1.c | 51 ++++++++++++++++++++--------
8+
Utilities/cmcurl/lib/vtls/x509asn1.h | 11 ++++++
9+
2 files changed, 47 insertions(+), 15 deletions(-)
10+
11+
diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c
12+
index ed84032a..b5412c50 100644
13+
--- a/Utilities/cmcurl/lib/vtls/x509asn1.c
14+
+++ b/Utilities/cmcurl/lib/vtls/x509asn1.c
15+
@@ -491,7 +491,7 @@ static CURLcode GTime2str(struct dynbuf *store,
16+
/* Convert an ASN.1 Generalized time to a printable string.
17+
Return the dynamically allocated string, or NULL if an error occurs. */
18+
19+
- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
20+
+ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
21+
;
22+
23+
/* Get seconds digits. */
24+
@@ -510,32 +510,44 @@ static CURLcode GTime2str(struct dynbuf *store,
25+
return CURLE_BAD_FUNCTION_ARGUMENT;
26+
}
27+
28+
- /* Scan for timezone, measure fractional seconds. */
29+
+ /* timezone follows optional fractional seconds. */
30+
tzp = fracp;
31+
- fracl = 0;
32+
+ fracl = 0; /* no fractional seconds detected so far */
33+
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
34+
- fracp++;
35+
- do
36+
+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
37+
+ fracp++; /* should be a digit char or BAD ARGUMENT */
38+
+ tzp = fracp;
39+
+ while(tzp < end && ISDIGIT(*tzp))
40+
tzp++;
41+
- while(tzp < end && *tzp >= '0' && *tzp <= '9');
42+
- /* Strip leading zeroes in fractional seconds. */
43+
- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
44+
- ;
45+
+ if(tzp == fracp) /* never looped, no digit after [.,] */
46+
+ return CURLE_BAD_FUNCTION_ARGUMENT;
47+
+ fracl = tzp - fracp; /* number of fractional sec digits */
48+
+ DEBUGASSERT(fracl > 0);
49+
+ /* Strip trailing zeroes in fractional seconds.
50+
+ * May reduce fracl to 0 if only '0's are present. */
51+
+ while(fracl && fracp[fracl - 1] == '0')
52+
+ fracl--;
53+
}
54+
55+
/* Process timezone. */
56+
- if(tzp >= end)
57+
- ; /* Nothing to do. */
58+
+ if(tzp >= end) {
59+
+ tzp = "";
60+
+ tzl = 0;
61+
+ }
62+
else if(*tzp == 'Z') {
63+
- tzp = " GMT";
64+
- end = tzp + 4;
65+
+ sep = " ";
66+
+ tzp = "GMT";
67+
+ tzl = 3;
68+
+ }
69+
+ else if((*tzp == '+') || (*tzp == '-')) {
70+
+ sep = " UTC";
71+
+ tzl = end - tzp;
72+
}
73+
else {
74+
sep = " ";
75+
- tzp++;
76+
+ tzl = end - tzp;
77+
}
78+
79+
- tzl = end - tzp;
80+
return Curl_dyn_addf(store,
81+
"%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
82+
beg, beg + 4, beg + 6,
83+
@@ -544,6 +556,15 @@ static CURLcode GTime2str(struct dynbuf *store,
84+
sep, (int)tzl, tzp);
85+
}
86+
87+
+#ifdef UNITTESTS
88+
+/* used by unit1656.c */
89+
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
90+
+ const char *beg, const char *end)
91+
+{
92+
+ return GTime2str(store, beg, end);
93+
+}
94+
+#endif
95+
+
96+
/*
97+
* Convert an ASN.1 UTC time to a printable string.
98+
*
99+
diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.h b/Utilities/cmcurl/lib/vtls/x509asn1.h
100+
index 23a67b82..1d8bbabc 100644
101+
--- a/Utilities/cmcurl/lib/vtls/x509asn1.h
102+
+++ b/Utilities/cmcurl/lib/vtls/x509asn1.h
103+
@@ -76,5 +76,16 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
104+
const char *beg, const char *end);
105+
CURLcode Curl_verifyhost(struct Curl_cfilter *cf, struct Curl_easy *data,
106+
const char *beg, const char *end);
107+
+
108+
+#ifdef UNITTESTS
109+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
110+
+ defined(USE_MBEDTLS)
111+
+
112+
+/* used by unit1656.c */
113+
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
114+
+ const char *beg, const char *end);
115+
+#endif
116+
+#endif
117+
+
118+
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP */
119+
#endif /* HEADER_CURL_X509ASN1_H */
120+
--
121+
2.45.2
122+

‎SPECS/cmake/CVE-2024-9681.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 62c0d5d5862df10ac671f5a94d49d30ec025aae2 Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Tue, 21 Jan 2025 11:57:45 +0000
4+
Subject: [PATCH] CVE-2024-9681.patch
5+
6+
Backported form: https://github.com/curl/curl/commit/a94973805df96269bf
7+
---
8+
Utilities/cmcurl/lib/hsts.c | 14 ++++++++++----
9+
1 file changed, 10 insertions(+), 4 deletions(-)
10+
11+
diff --git a/Utilities/cmcurl/lib/hsts.c b/Utilities/cmcurl/lib/hsts.c
12+
index a5e76761..d1e434f2 100644
13+
--- a/Utilities/cmcurl/lib/hsts.c
14+
+++ b/Utilities/cmcurl/lib/hsts.c
15+
@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
16+
struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
17+
bool subdomain)
18+
{
19+
+ struct stsentry *bestsub = NULL;
20+
if(h) {
21+
char buffer[MAX_HSTS_HOSTLEN + 1];
22+
time_t now = time(NULL);
23+
size_t hlen = strlen(hostname);
24+
struct Curl_llist_element *e;
25+
struct Curl_llist_element *n;
26+
+ size_t blen = 0;
27+
28+
if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
29+
return NULL;
30+
@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
31+
if(ntail < hlen) {
32+
size_t offs = hlen - ntail;
33+
if((hostname[offs-1] == '.') &&
34+
- strncasecompare(&hostname[offs], sts->host, ntail))
35+
- return sts;
36+
+ strncasecompare(&hostname[offs], sts->host, ntail) &&
37+
+ (ntail > blen)) {
38+
+ /* save the tail match with the longest tail */
39+
+ bestsub = sts;
40+
+ blen = ntail;
41+
+ }
42+
}
43+
}
44+
if(strcasecompare(hostname, sts->host))
45+
return sts;
46+
}
47+
}
48+
- return NULL; /* no match */
49+
+ return bestsub;
50+
}
51+
52+
/*
53+
@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line)
54+
e = Curl_hsts(h, p, subdomain);
55+
if(!e)
56+
result = hsts_create(h, p, subdomain, expires);
57+
- else {
58+
+ else if(strcasecompare(p, e->host)) {
59+
/* the same host name, use the largest expire time */
60+
if(expires > e->expires)
61+
e->expires = expires;
62+
--
63+
2.45.2
64+

‎SPECS/cmake/cmake.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.30.3
5-
Release: 3%{?dist}
5+
Release: 4%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -15,6 +15,8 @@ Patch1: CVE-2024-6197.patch
1515
Patch2: CVE-2024-6874.patch
1616
Patch3: CVE-2024-8096.patch
1717
Patch4: CVE-2024-11053.patch
18+
Patch5: CVE-2024-7264.patch
19+
Patch6: CVE-2024-9681.patch
1820
BuildRequires: bzip2
1921
BuildRequires: bzip2-devel
2022
BuildRequires: curl
@@ -94,6 +96,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
9496
%{_libdir}/rpm/macros.d/macros.cmake
9597

9698
%changelog
99+
* Tue Jan 22 2025 Jyoti Kanase <[email protected]> - 3.30.3-4
100+
- Fix CVE-2024-7264 and CVE-2024-9681
101+
97102
* Wed Jan 15 2025 Henry Beberman <[email protected]> - 3.30.3-3
98103
- Patch vendored curl for CVE-2024-11053
99104

‎toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
4949
chkconfig-1.25-1.azl3.aarch64.rpm
5050
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
5151
chkconfig-lang-1.25-1.azl3.aarch64.rpm
52-
cmake-3.30.3-3.azl3.aarch64.rpm
53-
cmake-debuginfo-3.30.3-3.azl3.aarch64.rpm
52+
cmake-3.30.3-4.azl3.aarch64.rpm
53+
cmake-debuginfo-3.30.3-4.azl3.aarch64.rpm
5454
coreutils-9.4-6.azl3.aarch64.rpm
5555
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
5656
coreutils-lang-9.4-6.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
5252
chkconfig-1.25-1.azl3.x86_64.rpm
5353
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
5454
chkconfig-lang-1.25-1.azl3.x86_64.rpm
55-
cmake-3.30.3-3.azl3.x86_64.rpm
56-
cmake-debuginfo-3.30.3-3.azl3.x86_64.rpm
55+
cmake-3.30.3-4.azl3.x86_64.rpm
56+
cmake-debuginfo-3.30.3-4.azl3.x86_64.rpm
5757
coreutils-9.4-6.azl3.x86_64.rpm
5858
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
5959
coreutils-lang-9.4-6.azl3.x86_64.rpm

0 commit comments

Comments
 (0)