From 1e155330f6cf132997b91a7cfdfe7de319410566 Mon Sep 17 00:00:00 2001 From: Catalin Popeanga Date: Thu, 9 Oct 2014 14:25:15 +0200 Subject: bash: Fix-for-CVE-2014-6278 This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277 See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278 (From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae) Signed-off-by: Catalin Popeanga Signed-off-by: Paul Eggleton --- .../bash/bash-4.2/cve-2014-6278.patch | 127 +++++++++++++++++++++ 1 file changed, 127 insertions(+) create mode 100644 meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch (limited to 'meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch') diff --git a/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch b/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch new file mode 100644 index 0000000000..b25314fcd7 --- /dev/null +++ b/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch @@ -0,0 +1,127 @@ +bash: Fix CVE-2014-6278 (shellshock) + +Upstream-status: backport + +Downloaded from: +http://ftp.gnu.org/gnu/bash/bash-4.2-patches/bash42-053 + +Author: Chet Ramey +Signed-off-by: Paul Eggleton + + BASH PATCH REPORT + ================= + +Bash-Release: 4.2 +Patch-ID: bash42-053 + +Bug-Reported-by: Michal Zalewski +Bug-Reference-ID: +Bug-Reference-URL: + +Bug-Description: + +A combination of nested command substitutions and function importing from +the environment can cause bash to execute code appearing in the environment +variable value following the function definition. + +Patch (apply with `patch -p0'): + +*** ../bash-4.2.52/builtins/evalstring.c 2014-09-16 19:35:45.000000000 -0400 +--- builtins/evalstring.c 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 262,271 **** + struct fd_bitmap *bitmap; + +! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) + { +! internal_warning ("%s: ignoring function definition attempt", from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! break; + } + +--- 262,284 ---- + struct fd_bitmap *bitmap; + +! if (flags & SEVAL_FUNCDEF) + { +! char *x; +! +! /* If the command parses to something other than a straight +! function definition, or if we have not consumed the entire +! string, or if the parser has transformed the function +! name (as parsing will if it begins or ends with shell +! whitespace, for example), reject the attempt */ +! if (command->type != cm_function_def || +! ((x = parser_remaining_input ()) && *x) || +! (STREQ (from_file, command->value.Function_def->name->word) == 0)) +! { +! internal_warning (_("%s: ignoring function definition attempt"), from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! reset_parser (); +! break; +! } + } + +*************** +*** 332,336 **** + + if (flags & SEVAL_ONECMD) +! break; + } + } +--- 345,352 ---- + + if (flags & SEVAL_ONECMD) +! { +! reset_parser (); +! break; +! } + } + } +*** ../bash-4.2.52/parse.y 2014-09-30 19:24:19.000000000 -0400 +--- parse.y 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 2436,2439 **** +--- 2436,2449 ---- + } + ++ char * ++ parser_remaining_input () ++ { ++ if (shell_input_line == 0) ++ return 0; ++ if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) ++ return '\0'; /* XXX */ ++ return (shell_input_line + shell_input_line_index); ++ } ++ + #ifdef INCLUDE_UNUSED + /* Back the input pointer up by one, effectively `ungetting' a character. */ +*************** +*** 3891,3896 **** + /* reset_parser clears shell_input_line and associated variables */ + restore_input_line_state (&ls); +! if (interactive) +! token_to_read = 0; + + /* Need to find how many characters parse_and_execute consumed, update +--- 3901,3906 ---- + /* reset_parser clears shell_input_line and associated variables */ + restore_input_line_state (&ls); +! +! token_to_read = 0; + + /* Need to find how many characters parse_and_execute consumed, update +*** ../bash-4.2.52/shell.h 2011-11-21 18:03:32.000000000 -0500 +--- shell.h 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 178,181 **** +--- 178,183 ---- + + /* Let's try declaring these here. */ ++ extern char *parser_remaining_input __P((void)); ++ + extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *)); + extern void restore_parser_state __P((sh_parser_state_t *)); -- cgit 1.2.3-korg