busybox: Patch CVE-2023-42363

Backport patch for CVE-2023-42363.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-core/busybox/busybox/CVE-2023-42363.patch b/meta/recipes-core/busybox/busybox/CVE-2023-42363.patch
new file mode 100644 (file)
index 0000000..379f6f8
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2023-42363.patch
@@ -0,0 +1,67 @@
+From fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Mon, 20 May 2024 17:55:28 +0200
+Subject: [PATCH] awk: fix use after free (CVE-2023-42363)
+
+function                                             old     new   delta
+evaluate                                            3377    3385      +8
+
+Fixes https://bugs.busybox.net/show_bug.cgi?id=15865
+
+Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+CVE: CVE-2023-42363
+Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ editors/awk.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 0981c6735..ff6d6350b 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -2910,19 +2910,14 @@ static var *evaluate(node *op, var *res)
+                               /* yes, remember where Fields[] is */
+                               old_Fields_ptr = Fields;
+                       }
+-                      if (opinfo & OF_STR1) {
+-                              L.s = getvar_s(L.v);
+-                              debug_printf_eval("L.s:'%s'\n", L.s);
+-                      }
+                       if (opinfo & OF_NUM1) {
+                               L_d = getvar_i(L.v);
+                               debug_printf_eval("L_d:%f\n", L_d);
+                       }
+               }
+-              /* NB: Must get string/numeric values of L (done above)
+-               * _before_ evaluate()'ing R.v: if both L and R are $NNNs,
+-               * and right one is large, then L.v points to Fields[NNN1],
+-               * second evaluate() reallocates and moves (!) Fields[],
++              /* NB: if both L and R are $NNNs, and right one is large,
++               * then at this pint L.v points to Fields[NNN1], second
++               * evaluate() below reallocates and moves (!) Fields[],
+                * R.v points to Fields[NNN2] but L.v now points to freed mem!
+                * (Seen trying to evaluate "$444 $44444")
+                */
+@@ -2942,6 +2937,16 @@ static var *evaluate(node *op, var *res)
+                               debug_printf_eval("R.s:'%s'\n", R.s);
+                       }
+               }
++              /* Get L.s _after_ R.v is evaluated: it may have realloc'd L.v
++               * so we must get the string after "old_Fields_ptr" correction
++               * above. Testcase: x = (v = "abc", gsub("b", "X", v));
++               */
++              if (opinfo & OF_RES1) {
++                      if (opinfo & OF_STR1) {
++                              L.s = getvar_s(L.v);
++                              debug_printf_eval("L.s:'%s'\n", L.s);
++                      }
++              }
+ 
+               debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
+               switch (XC(opinfo & OPCLSMASK)) {
+-- 
+2.30.2
+

diff --git a/meta/recipes-core/busybox/busybox_1.36.1.bb b/meta/recipes-core/busybox/busybox_1.36.1.bb
index 46e719845a07f9b1519c5cdecd0d16adc9ec912f..7ce57bb0d0073aa97235afbff6cd6bf223bea21f 100644 (file)
--- a/meta/recipes-core/busybox/busybox_1.36.1.bb
+++ b/meta/recipes-core/busybox/busybox_1.36.1.bb
@@ -51,6 +51,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://start-stop-false.patch \
            file://CVE-2021-42380.patch \
            file://0001-awk-fix-segfault-when-compiled-by-clang.patch \
+           file://CVE-2023-42363.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg "
 # TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html