Skip to content

Commit 5de4b48

Browse files
CBL-Mariner-BotAnkita13-code
CBL-Mariner-Bot
and
Ankita13-code
authored
[AUTO-CHERRYPICK] gnutls: Address CVE-2024-12133 [Medium] - branch main (#12663)
Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>
1 parent de65cb9 commit 5de4b48

2 files changed

Lines changed: 233 additions & 1 deletion

File tree

‎SPECS/gnutls/CVE-2024-12133.patch‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
From 1ca74c7814f9c58929755ce5b3b66262564543d1 Mon Sep 17 00:00:00 2001
2+
From: Ankita Pareek <ankitapareek@microsoft.com>
3+
Date: Wed, 26 Feb 2025 21:28:46 +0530
4+
Subject: [PATCH] gnutls: Add patch for CVE-2024-12133. Upstream fix:
5+
https://gitlab.com/gnutls/libtasn1/-/commit/869a97aa259dffa2620dabcad84e1c22545ffc3d
6+
7+
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
8+
---
9+
lib/minitasn1/element.c | 56 +++++++++++++++++++++++++++++++++-----
10+
lib/minitasn1/element.h | 10 +++++++
11+
lib/minitasn1/int.h | 8 ++++++
12+
lib/minitasn1/parser_aux.c | 10 +++++++
13+
lib/minitasn1/structure.c | 13 +++++++++
14+
5 files changed, 90 insertions(+), 7 deletions(-)
15+
16+
diff --git a/lib/minitasn1/element.c b/lib/minitasn1/element.c
17+
index 550fdb2..67434a8 100644
18+
--- a/lib/minitasn1/element.c
19+
+++ b/lib/minitasn1/element.c
20+
@@ -32,6 +32,8 @@
21+
#include "structure.h"
22+
#include "c-ctype.h"
23+
#include "element.h"
24+
+#include <limits.h>
25+
+#include "intprops.h"
26+
27+
void
28+
_asn1_hierarchical_name (asn1_node_const node, char *name, int name_size)
29+
@@ -128,6 +130,41 @@ _asn1_convert_integer (const unsigned char *value, unsigned char *value_out,
30+
return ASN1_SUCCESS;
31+
}
32+
33+
+int
34+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
35+
+ asn1_node node)
36+
+{
37+
+ if (position >= array->size)
38+
+ {
39+
+ size_t new_size = position, i;
40+
+ asn1_node *new_nodes;
41+
+
42+
+ if (INT_MULTIPLY_OVERFLOW (new_size, 2))
43+
+ return ASN1_GENERIC_ERROR;
44+
+ new_size *= 2;
45+
+
46+
+ if (INT_ADD_OVERFLOW (new_size, 1))
47+
+ return ASN1_GENERIC_ERROR;
48+
+ new_size += 1;
49+
+
50+
+ if (INT_MULTIPLY_OVERFLOW (new_size, sizeof (*new_nodes)))
51+
+ return ASN1_GENERIC_ERROR;
52+
+
53+
+ new_nodes = realloc (array->nodes, new_size * sizeof (*new_nodes));
54+
+ if (!new_nodes)
55+
+ return ASN1_MEM_ALLOC_ERROR;
56+
+
57+
+ for (i = array->size; i < new_size; i++)
58+
+ new_nodes[i] = NULL;
59+
+
60+
+ array->nodes = new_nodes;
61+
+ array->size = new_size;
62+
+ }
63+
+
64+
+ array->nodes[position] = node;
65+
+ return ASN1_SUCCESS;
66+
+}
67+
+
68+
/* Appends a new element into the sequence (or set) defined by this
69+
* node. The new element will have a name of '?number', where number
70+
* is a monotonically increased serial number.
71+
@@ -144,6 +181,7 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
72+
asn1_node p, p2;
73+
char temp[LTOSTR_MAX_SIZE+1];
74+
long n;
75+
+ int result;
76+
77+
if (!node || !(node->down))
78+
return ASN1_GENERIC_ERROR;
79+
@@ -176,17 +214,21 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
80+
pcache->tail = p2;
81+
}
82+
83+
- if (p->name[0] == 0)
84+
- _asn1_str_cpy (temp, sizeof (temp), "?1");
85+
- else
86+
+ n = 0;
87+
+ if (p->name[0] != 0)
88+
{
89+
- n = strtol (p->name + 1, NULL, 0);
90+
- n++;
91+
- temp[0] = '?';
92+
- _asn1_ltostr (n, temp + 1);
93+
+ n = strtol (p->name + 1, NULL, 10);
94+
+ if (n <= 0 || n >= LONG_MAX - 1)
95+
+ return ASN1_GENERIC_ERROR;
96+
}
97+
+ temp[0] = '?';
98+
+ _asn1_ltostr (n + 1, temp + 1);
99+
_asn1_set_name (p2, temp);
100+
/* p2->type |= CONST_OPTION; */
101+
+ result = _asn1_node_array_set (&node->numbered_children, n, p2);
102+
+ if (result != ASN1_SUCCESS)
103+
+ return result;
104+
+ p2->parent = node;
105+
106+
return ASN1_SUCCESS;
107+
}
108+
diff --git a/lib/minitasn1/element.h b/lib/minitasn1/element.h
109+
index 717bfaf..0ff92bd 100644
110+
--- a/lib/minitasn1/element.h
111+
+++ b/lib/minitasn1/element.h
112+
@@ -37,4 +37,14 @@ int _asn1_convert_integer (const unsigned char *value,
113+
114+
void _asn1_hierarchical_name (asn1_node_const node, char *name, int name_size);
115+
116+
+static inline asn1_node_const
117+
+_asn1_node_array_get (const struct asn1_node_array_st *array, size_t position)
118+
+{
119+
+ return position < array->size ? array->nodes[position] : NULL;
120+
+}
121+
+
122+
+int
123+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
124+
+ asn1_node node);
125+
+
126+
#endif
127+
diff --git a/lib/minitasn1/int.h b/lib/minitasn1/int.h
128+
index 57f1efd..163a423 100644
129+
--- a/lib/minitasn1/int.h
130+
+++ b/lib/minitasn1/int.h
131+
@@ -39,6 +39,12 @@
132+
133+
#define ASN1_SMALL_VALUE_SIZE 16
134+
135+
+struct asn1_node_array_st
136+
+{
137+
+ asn1_node *nodes;
138+
+ size_t size;
139+
+};
140+
+
141+
/* This structure is also in libtasn1.h, but then contains less
142+
fields. You cannot make any modifications to these first fields
143+
without breaking ABI. */
144+
@@ -55,6 +61,8 @@ struct asn1_node_st
145+
asn1_node left; /* Pointer to the next list element */
146+
/* private fields: */
147+
unsigned char small_value[ASN1_SMALL_VALUE_SIZE]; /* For small values */
148+
+ asn1_node parent; /* Pointer to the parent node */
149+
+ struct asn1_node_array_st numbered_children; /* Array of unnamed child nodes for caching */
150+
151+
/* values used during decoding/coding */
152+
int tmp_ival;
153+
diff --git a/lib/minitasn1/parser_aux.c b/lib/minitasn1/parser_aux.c
154+
index bb88ab9..d6764d7 100644
155+
--- a/lib/minitasn1/parser_aux.c
156+
+++ b/lib/minitasn1/parser_aux.c
157+
@@ -127,6 +127,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
158+
const char *n_start;
159+
unsigned int nsize;
160+
unsigned int nhash;
161+
+ const struct asn1_node_array_st *numbered_children;
162+
163+
if (pointer == NULL)
164+
return NULL;
165+
@@ -210,6 +211,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
166+
if (p->down == NULL)
167+
return NULL;
168+
169+
+ numbered_children = &p->numbered_children;
170+
p = p->down;
171+
if (p == NULL)
172+
return NULL;
173+
@@ -223,6 +225,12 @@ asn1_find_node (asn1_node_const pointer, const char *name)
174+
}
175+
else
176+
{ /* no "?LAST" */
177+
+ if (n[0] == '?' && c_isdigit (n[1]))
178+
+ {
179+
+ long position = strtol (n + 1, NULL, 10);
180+
+ if (position > 0 && position < LONG_MAX)
181+
+ p = _asn1_node_array_get (numbered_children, position - 1);
182+
+ }
183+
while (p)
184+
{
185+
if (p->name_hash == nhash && !strcmp (p->name, n))
186+
@@ -510,6 +518,8 @@ _asn1_remove_node (asn1_node node, unsigned int flags)
187+
if (node->value != node->small_value)
188+
free (node->value);
189+
}
190+
+
191+
+ free (node->numbered_children.nodes);
192+
free (node);
193+
}
194+
195+
diff --git a/lib/minitasn1/structure.c b/lib/minitasn1/structure.c
196+
index 4f43335..4138c61 100644
197+
--- a/lib/minitasn1/structure.c
198+
+++ b/lib/minitasn1/structure.c
199+
@@ -31,6 +31,9 @@
200+
#include <structure.h>
201+
#include "parser_aux.h"
202+
#include <gstr.h>
203+
+#include "c-ctype.h"
204+
+#include "element.h"
205+
+#include <limits.h>
206+
207+
208+
extern char _asn1_identifierMissing[];
209+
@@ -390,6 +393,16 @@ asn1_delete_element (asn1_node structure, const char *element_name)
210+
if (source_node == NULL)
211+
return ASN1_ELEMENT_NOT_FOUND;
212+
213+
+ if (source_node->parent
214+
+ && source_node->name[0] == '?'
215+
+ && c_isdigit (source_node->name[1]))
216+
+ {
217+
+ long position = strtol (source_node->name + 1, NULL, 10);
218+
+ if (position > 0 && position < LONG_MAX)
219+
+ _asn1_node_array_set (&source_node->parent->numbered_children,
220+
+ position - 1, NULL);
221+
+ }
222+
+
223+
p2 = source_node->right;
224+
p3 = _asn1_find_left (source_node);
225+
if (!p3)
226+
--
227+
2.34.1
228+

‎SPECS/gnutls/gnutls.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: The GnuTLS Transport Layer Security Library
22
Name: gnutls
33
Version: 3.7.11
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv3+ AND LGPLv2.1+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: System Environment/Libraries
99
URL: https://www.gnutls.org
1010
Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz
11+
Patch0: CVE-2024-12133.patch
1112
BuildRequires: autogen-libopts-devel
1213
BuildRequires: gc-devel
1314
BuildRequires: guile-devel
@@ -94,6 +95,9 @@ sed -i 's/TESTS += test-ciphers-openssl.sh//' tests/slow/Makefile.am
9495
%{_mandir}/man3/*
9596

9697
%changelog
98+
* Wed Feb 26 2025 Ankita Pareek <ankitapareek@microsoft.com> - 3.7.11-2
99+
- Address CVE-2024-12133 with a patch
100+
97101
* Mon Sep 30 2024 Muhammad Falak <mwani@microsoft.com> - 3.7.11-1
98102
- Upgrade to v3.7.11 to address CVE-2023-5981, CVE-2024-28835, CVE-2024-28834, CVE-2024-0553
99103
- Drop patches which are already included in the source.

0 commit comments

Comments
 (0)