Skip to content

Commit 381cbeb

Browse files
CBL-Mariner-Botvinceaperri
CBL-Mariner-Bot
and
vinceaperri
authored
[AUTO-CHERRYPICK] cmake: Patch CVE-2024-2398, CVE-2024-7264 in bundled curl and CVE-2024-28182 in bundled nghttp2 - branch main (#11231)
Co-authored-by: Vince Perri <5596945+vinceaperri@users.noreply.github.com>
1 parent 73a888e commit 381cbeb

6 files changed

Lines changed: 335 additions & 5 deletions

File tree

‎SPECS/cmake/CVE-2024-2398.patch‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
From c9adb2114e9d9d4a50ff273234c2a1f8518aafd1 Mon Sep 17 00:00:00 2001
2+
From: Vince Perri <5596945+vinceaperri@users.noreply.github.com>
3+
Date: Wed, 20 Nov 2024 22:38:53 +0000
4+
Subject: [PATCH] http2: push headers better cleanup
5+
6+
Original patch: https://github.com/curl/curl/commit/deca8039991886a559b67bcd6
7+
---
8+
Utilities/cmcurl/lib/http2.c | 34 +++++++++++++++-------------------
9+
1 file changed, 15 insertions(+), 19 deletions(-)
10+
11+
diff --git a/Utilities/cmcurl/lib/http2.c b/Utilities/cmcurl/lib/http2.c
12+
index f194c18b..50b8cd54 100644
13+
--- a/Utilities/cmcurl/lib/http2.c
14+
+++ b/Utilities/cmcurl/lib/http2.c
15+
@@ -116,6 +116,15 @@ static int http2_getsock(struct Curl_easy *data,
16+
return bitmap;
17+
}
18+
19+
+static void free_push_headers(struct HTTP *stream)
20+
+{
21+
+ size_t i;
22+
+ for(i = 0; i<stream->push_headers_used; i++)
23+
+ free(stream->push_headers[i]);
24+
+ Curl_safefree(stream->push_headers);
25+
+ stream->push_headers_used = 0;
26+
+}
27+
+
28+
/*
29+
* http2_stream_free() free HTTP2 stream related data
30+
*/
31+
@@ -123,11 +132,7 @@ static void http2_stream_free(struct HTTP *http)
32+
{
33+
if(http) {
34+
Curl_dyn_free(&http->header_recvbuf);
35+
- for(; http->push_headers_used > 0; --http->push_headers_used) {
36+
- free(http->push_headers[http->push_headers_used - 1]);
37+
- }
38+
- free(http->push_headers);
39+
- http->push_headers = NULL;
40+
+ free_push_headers(http);
41+
}
42+
}
43+
44+
@@ -559,7 +564,6 @@ static int push_promise(struct Curl_easy *data,
45+
struct curl_pushheaders heads;
46+
CURLMcode rc;
47+
struct http_conn *httpc;
48+
- size_t i;
49+
/* clone the parent */
50+
struct Curl_easy *newhandle = duphandle(data);
51+
if(!newhandle) {
52+
@@ -595,11 +599,7 @@ static int push_promise(struct Curl_easy *data,
53+
Curl_set_in_callback(data, false);
54+
55+
/* free the headers again */
56+
- for(i = 0; i<stream->push_headers_used; i++)
57+
- free(stream->push_headers[i]);
58+
- free(stream->push_headers);
59+
- stream->push_headers = NULL;
60+
- stream->push_headers_used = 0;
61+
+ free_push_headers(stream);
62+
63+
if(rv) {
64+
DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT));
65+
@@ -1033,10 +1033,10 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
66+
stream->push_headers_alloc) {
67+
char **headp;
68+
stream->push_headers_alloc *= 2;
69+
- headp = Curl_saferealloc(stream->push_headers,
70+
- stream->push_headers_alloc * sizeof(char *));
71+
+ headp = realloc(stream->push_headers,
72+
+ stream->push_headers_alloc * sizeof(char *));
73+
if(!headp) {
74+
- stream->push_headers = NULL;
75+
+ free_push_headers(stream);
76+
return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
77+
}
78+
stream->push_headers = headp;
79+
@@ -1204,11 +1204,7 @@ void Curl_http2_done(struct Curl_easy *data, bool premature)
80+
Curl_dyn_free(&http->trailer_recvbuf);
81+
if(http->push_headers) {
82+
/* if they weren't used and then freed before */
83+
- for(; http->push_headers_used > 0; --http->push_headers_used) {
84+
- free(http->push_headers[http->push_headers_used - 1]);
85+
- }
86+
- free(http->push_headers);
87+
- http->push_headers = NULL;
88+
+ free_push_headers(http);
89+
}
90+
91+
if(!(data->conn->handler->protocol&PROTO_FAMILY_HTTP) ||
92+
--
93+
2.34.1
94+

‎SPECS/cmake/CVE-2024-28182.patch‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
From 875373fb67097281d4a4ff461e531b9bef947818 Mon Sep 17 00:00:00 2001
2+
From: Vince Perri <5596945+vinceaperri@users.noreply.github.com>
3+
Date: Thu, 21 Nov 2024 14:11:36 +0000
4+
Subject: [PATCH] Limit CONTINUATION frames following an incoming HEADER frame
5+
6+
Original patch: https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
7+
---
8+
Utilities/cmnghttp2/lib/includes/nghttp2/nghttp2.h | 7 ++++++-
9+
Utilities/cmnghttp2/lib/nghttp2_helper.c | 2 ++
10+
Utilities/cmnghttp2/lib/nghttp2_session.c | 8 ++++++++
11+
Utilities/cmnghttp2/lib/nghttp2_session.h | 10 ++++++++++
12+
4 files changed, 26 insertions(+), 1 deletion(-)
13+
14+
diff --git a/Utilities/cmnghttp2/lib/includes/nghttp2/nghttp2.h b/Utilities/cmnghttp2/lib/includes/nghttp2/nghttp2.h
15+
index e4e1d4fc..a140199a 100644
16+
--- a/Utilities/cmnghttp2/lib/includes/nghttp2/nghttp2.h
17+
+++ b/Utilities/cmnghttp2/lib/includes/nghttp2/nghttp2.h
18+
@@ -428,7 +428,12 @@ typedef enum {
19+
* exhaustion on server side to send these frames forever and does
20+
* not read network.
21+
*/
22+
- NGHTTP2_ERR_FLOODED = -904
23+
+ NGHTTP2_ERR_FLOODED = -904,
24+
+ /**
25+
+ * When a local endpoint receives too many CONTINUATION frames
26+
+ * following a HEADER frame.
27+
+ */
28+
+ NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905,
29+
} nghttp2_error;
30+
31+
/**
32+
diff --git a/Utilities/cmnghttp2/lib/nghttp2_helper.c b/Utilities/cmnghttp2/lib/nghttp2_helper.c
33+
index 91136a61..f150ab54 100644
34+
--- a/Utilities/cmnghttp2/lib/nghttp2_helper.c
35+
+++ b/Utilities/cmnghttp2/lib/nghttp2_helper.c
36+
@@ -334,6 +334,8 @@ const char *nghttp2_strerror(int error_code) {
37+
case NGHTTP2_ERR_FLOODED:
38+
return "Flooding was detected in this HTTP/2 session, and it must be "
39+
"closed";
40+
+ case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS:
41+
+ return "Too many CONTINUATION frames following a HEADER frame";
42+
default:
43+
return "Unknown error code";
44+
}
45+
diff --git a/Utilities/cmnghttp2/lib/nghttp2_session.c b/Utilities/cmnghttp2/lib/nghttp2_session.c
46+
index a3c0b708..f02e3f95 100644
47+
--- a/Utilities/cmnghttp2/lib/nghttp2_session.c
48+
+++ b/Utilities/cmnghttp2/lib/nghttp2_session.c
49+
@@ -463,6 +463,7 @@ static int session_new(nghttp2_session **session_ptr,
50+
51+
(*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN;
52+
(*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM;
53+
+ (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS;
54+
55+
if (option) {
56+
if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) &&
57+
@@ -6297,6 +6298,8 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
58+
}
59+
}
60+
session_inbound_frame_reset(session);
61+
+
62+
+ session->num_continuations = 0;
63+
}
64+
break;
65+
}
66+
@@ -6418,6 +6421,11 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
67+
}
68+
#endif /* DEBUGBUILD */
69+
70+
+
71+
+ if (++session->num_continuations > session->max_continuations) {
72+
+ return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS;
73+
+ }
74+
+
75+
readlen = inbound_frame_buf_read(iframe, in, last);
76+
in += readlen;
77+
78+
diff --git a/Utilities/cmnghttp2/lib/nghttp2_session.h b/Utilities/cmnghttp2/lib/nghttp2_session.h
79+
index b75294c3..f53acac7 100644
80+
--- a/Utilities/cmnghttp2/lib/nghttp2_session.h
81+
+++ b/Utilities/cmnghttp2/lib/nghttp2_session.h
82+
@@ -107,6 +107,10 @@ typedef struct {
83+
#define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000
84+
#define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33
85+
86+
+/* The default max number of CONTINUATION frames following an incoming
87+
+ HEADER frame. */
88+
+#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8
89+
+
90+
/* Internal state when receiving incoming frame */
91+
typedef enum {
92+
/* Receiving frame header */
93+
@@ -277,6 +281,12 @@ struct nghttp2_session {
94+
/* The maximum length of header block to send. Calculated by the
95+
same way as nghttp2_hd_deflate_bound() does. */
96+
size_t max_send_header_block_length;
97+
+ /* The maximum number of CONTINUATION frames following an incoming
98+
+ HEADER frame. */
99+
+ size_t max_continuations;
100+
+ /* The number of CONTINUATION frames following an incoming HEADER
101+
+ frame. This variable is reset when END_HEADERS flag is seen. */
102+
+ size_t num_continuations;
103+
/* Next Stream ID. Made unsigned int to detect >= (1 << 31). */
104+
uint32_t next_stream_id;
105+
/* The last stream ID this session initiated. For client session,
106+
--
107+
2.34.1
108+

‎SPECS/cmake/CVE-2024-7264.patch‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
From e5daecf74dd60974e7ae91e432032e6cfdaaf15e Mon Sep 17 00:00:00 2001
2+
From: Vince Perri <5596945+vinceaperri@users.noreply.github.com>
3+
Date: Thu, 21 Nov 2024 14:52:49 +0000
4+
Subject: [PATCH 1/2] x509asn1: clean up GTime2str
5+
6+
Original patch: https://github.com/curl/curl/commit/3c914bc680155b321
7+
---
8+
Utilities/cmcurl/lib/x509asn1.c | 23 ++++++++++++++---------
9+
1 file changed, 14 insertions(+), 9 deletions(-)
10+
11+
diff --git a/Utilities/cmcurl/lib/x509asn1.c b/Utilities/cmcurl/lib/x509asn1.c
12+
index 281c9724..b1160102 100644
13+
--- a/Utilities/cmcurl/lib/x509asn1.c
14+
+++ b/Utilities/cmcurl/lib/x509asn1.c
15+
@@ -469,7 +469,7 @@ static const char *GTime2str(const char *beg, const char *end)
16+
/* Convert an ASN.1 Generalized time to a printable string.
17+
Return the dynamically allocated string, or NULL if an error occurs. */
18+
19+
- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
20+
+ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
21+
;
22+
23+
/* Get seconds digits. */
24+
@@ -488,17 +488,22 @@ static const char *GTime2str(const char *beg, const char *end)
25+
return NULL;
26+
}
27+
28+
- /* Scan for timezone, measure fractional seconds. */
29+
+ /* timezone follows optional fractional seconds. */
30+
tzp = fracp;
31+
- fracl = 0;
32+
+ fracl = 0; /* no fractional seconds detected so far */
33+
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
34+
- fracp++;
35+
- do
36+
+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
37+
+ tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
38+
+ while(tzp < end && ISDIGIT(*tzp))
39+
tzp++;
40+
- while(tzp < end && *tzp >= '0' && *tzp <= '9');
41+
- /* Strip leading zeroes in fractional seconds. */
42+
- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
43+
- ;
44+
+ if(tzp == fracp) /* never looped, no digit after [.,] */
45+
+ return CURLE_BAD_FUNCTION_ARGUMENT;
46+
+ fracl = tzp - fracp - 1; /* number of fractional sec digits */
47+
+ DEBUGASSERT(fracl > 0);
48+
+ /* Strip trailing zeroes in fractional seconds.
49+
+ * May reduce fracl to 0 if only '0's are present. */
50+
+ while(fracl && fracp[fracl - 1] == '0')
51+
+ fracl--;
52+
}
53+
54+
/* Process timezone. */
55+
--
56+
2.34.1
57+
58+
From 13e627cf5b98be84a8cead6e4518932dba7f2cb7 Mon Sep 17 00:00:00 2001
59+
From: Vince Perri <5596945+vinceaperri@users.noreply.github.com>
60+
Date: Thu, 21 Nov 2024 15:02:39 +0000
61+
Subject: [PATCH 2/2] x509asn1: fixes for gtime2str
62+
63+
Original patch: https://github.com/curl/curl/commit/27959ecce75cdb2
64+
---
65+
Utilities/cmcurl/lib/x509asn1.c | 23 +++++++++++++++--------
66+
1 file changed, 15 insertions(+), 8 deletions(-)
67+
68+
diff --git a/Utilities/cmcurl/lib/x509asn1.c b/Utilities/cmcurl/lib/x509asn1.c
69+
index b1160102..ceb03e2a 100644
70+
--- a/Utilities/cmcurl/lib/x509asn1.c
71+
+++ b/Utilities/cmcurl/lib/x509asn1.c
72+
@@ -493,12 +493,13 @@ static const char *GTime2str(const char *beg, const char *end)
73+
fracl = 0; /* no fractional seconds detected so far */
74+
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
75+
/* Have fractional seconds, e.g. "[.,]\d+". How many? */
76+
- tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
77+
+ fracp++; /* should be a digit char or BAD ARGUMENT */
78+
+ tzp = fracp;
79+
while(tzp < end && ISDIGIT(*tzp))
80+
tzp++;
81+
if(tzp == fracp) /* never looped, no digit after [.,] */
82+
return CURLE_BAD_FUNCTION_ARGUMENT;
83+
- fracl = tzp - fracp - 1; /* number of fractional sec digits */
84+
+ fracl = tzp - fracp; /* number of fractional sec digits */
85+
DEBUGASSERT(fracl > 0);
86+
/* Strip trailing zeroes in fractional seconds.
87+
* May reduce fracl to 0 if only '0's are present. */
88+
@@ -507,18 +508,24 @@ static const char *GTime2str(const char *beg, const char *end)
89+
}
90+
91+
/* Process timezone. */
92+
- if(tzp >= end)
93+
- ; /* Nothing to do. */
94+
+ if(tzp >= end) {
95+
+ tzp = "";
96+
+ tzl = 0;
97+
+ }
98+
else if(*tzp == 'Z') {
99+
- tzp = " GMT";
100+
- end = tzp + 4;
101+
+ sep = " ";
102+
+ tzp = "GMT";
103+
+ tzl = 3;
104+
+ }
105+
+ else if((*tzp == '+') || (*tzp == '-')) {
106+
+ sep = " UTC";
107+
+ tzl = end - tzp;
108+
}
109+
else {
110+
sep = " ";
111+
- tzp++;
112+
+ tzl = end - tzp;
113+
}
114+
115+
- tzl = end - tzp;
116+
return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
117+
beg, beg + 4, beg + 6,
118+
beg + 8, beg + 10, sec1, sec2,
119+
--
120+
2.34.1
121+

‎SPECS/cmake/cmake.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 13%{?dist}
5+
Release: 14%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -29,6 +29,9 @@ Patch14: CVE-2023-27538.patch
2929
Patch15: CVE-2023-27535.patch
3030
Patch16: CVE-2023-23916.patch
3131
Patch17: CVE-2023-46218.patch
32+
Patch18: CVE-2024-2398.patch
33+
Patch19: CVE-2024-28182.patch
34+
Patch20: CVE-2024-7264.patch
3235
BuildRequires: bzip2
3336
BuildRequires: bzip2-devel
3437
BuildRequires: curl
@@ -94,6 +97,10 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
9497
%{_prefix}/doc/%{name}-*/*
9598

9699
%changelog
100+
* Thu Nov 21 2024 Vince Perri <viperri@microsoft.com> - 3.21.4-14
101+
- Patch CVE-2024-2398 and CVE-2024-7264 (bundled curl)
102+
- Patch CVE-2024-28182 (bundled nghttp2)
103+
97104
* Thu Nov 14 2024 Sharath Srikanth Chellappa <sharathsr@microsoft.com> - 3.21.4-13
98105
- Patch CVE-2022-43552, CVE-2023-27536, CVE-2023-27535, CVE-2023-27538, CVE-2023-23916 and CVE-2023-46218.
99106

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-13.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-13.cm2.aarch64.rpm
33+
cmake-3.21.4-14.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-14.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-13.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-13.cm2.x86_64.rpm
34+
cmake-3.21.4-14.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-14.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)