Skip to content

Commit c36b50d

Browse files
CBL-Mariner-BotKanishk-BansalPawelWMS
authored
[AUTO-CHERRYPICK] Patch dnf5 CVE-2024-1929, CVE-2024-1930, CVE-2024-2746 [High] - branch 3.0-dev (#13679)
Signed-off-by: Kanishk-Bansal <kbkanishk975@gmail.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
1 parent 4af3c90 commit c36b50d

4 files changed

Lines changed: 138 additions & 1 deletion

File tree

‎SPECS/dnf5/CVE-2024-1929.patch‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 6e51bf2f0d585ab661806076c1e428c6482ddf86 Mon Sep 17 00:00:00 2001
2+
From: Marek Blaha <mblaha@redhat.com>
3+
Date: Tue, 23 Jan 2024 10:08:51 +0100
4+
Subject: [PATCH] dnfdaemon: Explicitly specify allowed config overrides
5+
6+
Limit main config options overrides for dnfdaemon session only to
7+
those explicitely allowed.
8+
---
9+
dnf5daemon-server/session.cpp | 35 ++++++++++++++++++++++++++++++++++-
10+
1 file changed, 34 insertions(+), 1 deletion(-)
11+
12+
diff --git a/dnf5daemon-server/session.cpp b/dnf5daemon-server/session.cpp
13+
index b5f2415b4..5322ddc08 100644
14+
--- a/dnf5daemon-server/session.cpp
15+
+++ b/dnf5daemon-server/session.cpp
16+
@@ -37,6 +37,34 @@ along with libdnf. If not, see <https://www.gnu.org/licenses/>.
17+
#include <iostream>
18+
#include <string>
19+
20+
+static const std::unordered_set<std::string> ALLOWED_MAIN_CONF_OVERRIDES = {
21+
+ "allow_downgrade",
22+
+ "allow_vendor_change",
23+
+ "best",
24+
+ "clean_requirements_on_remove",
25+
+ "disable_excludes",
26+
+ "exclude_from_weak",
27+
+ "exclude_from_weak_autodetect",
28+
+ "excludepkgs",
29+
+ "ignorearch",
30+
+ "includepkgs",
31+
+ "installonly_limit",
32+
+ "installonlypkgs",
33+
+ "install_weak_deps",
34+
+ "keepcache",
35+
+ "module_obsoletes",
36+
+ "module_platform_id",
37+
+ "module_stream_switch",
38+
+ "multilib_policy",
39+
+ "obsoletes",
40+
+ "optional_metadata_types",
41+
+ "protect_running_kernel",
42+
+ "reposdir",
43+
+ "skip_broken",
44+
+ "skip_if_unavailable",
45+
+ "skip_unavailable",
46+
+ "strict",
47+
+};
48+
49+
Session::Session(
50+
std::vector<std::unique_ptr<libdnf5::Logger>> && loggers,
51+
@@ -65,7 +93,12 @@ Session::Session(
52+
auto value = opt.second;
53+
auto bind = opt_binds.find(key);
54+
if (bind != opt_binds.end()) {
55+
- bind->second.new_string(libdnf5::Option::Priority::RUNTIME, value);
56+
+ if (ALLOWED_MAIN_CONF_OVERRIDES.find(key) != ALLOWED_MAIN_CONF_OVERRIDES.end()) {
57+
+ bind->second.new_string(libdnf5::Option::Priority::RUNTIME, value);
58+
+ } else {
59+
+ base->get_logger()->warning("Config option {} not allowed.", key);
60+
+ continue;
61+
+ }
62+
} else {
63+
base->get_logger()->warning("Unknown config option: {}", key);
64+
}

‎SPECS/dnf5/CVE-2024-1930.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From c090ffeb79da57b88d51da6ee76f02f6512c7d91 Mon Sep 17 00:00:00 2001
2+
From: Marek Blaha <mblaha@redhat.com>
3+
Date: Mon, 12 Feb 2024 09:40:02 +0100
4+
Subject: [PATCH] dnfdaemon: Limit number of simultaneously active sessions
5+
6+
---
7+
dnf5daemon-server/session_manager.cpp | 12 ++++++++++++
8+
1 file changed, 12 insertions(+)
9+
10+
diff --git a/dnf5daemon-server/session_manager.cpp b/dnf5daemon-server/session_manager.cpp
11+
index a5e1c14f7..b8439cf37 100644
12+
--- a/dnf5daemon-server/session_manager.cpp
13+
+++ b/dnf5daemon-server/session_manager.cpp
14+
@@ -26,11 +26,15 @@ along with libdnf. If not, see <https://www.gnu.org/licenses/>.
15+
#include <sdbus-c++/sdbus-c++.h>
16+
17+
#include <iostream>
18+
+#include <numeric>
19+
#include <random>
20+
#include <sstream>
21+
#include <string>
22+
#include <thread>
23+
24+
+// TODO(mblaha): Make this constant configurable
25+
+const int MAX_SESSIONS = 3;
26+
+
27+
SessionManager::SessionManager() {
28+
connection = sdbus::createSystemBusConnection(dnfdaemon::DBUS_NAME);
29+
dbus_register();
30+
@@ -98,6 +102,14 @@ sdbus::MethodReply SessionManager::open_session(sdbus::MethodCall & call) {
31+
if (!active) {
32+
throw sdbus::Error(dnfdaemon::ERROR, "Cannot open new session.");
33+
}
34+
+ // limit number of simultaneously opened sessions
35+
+ const int num_sessions = std::accumulate(
36+
+ sessions.begin(), sessions.end(), 0, [](int sum, const auto & sender) { return sum + sender.second.size(); });
37+
+ if (num_sessions >= MAX_SESSIONS) {
38+
+ auto reply = call.createErrorReply(sdbus::Error(
39+
+ dnfdaemon::ERROR, "Cannot open new session - maximal number of simultaneously opened sessions achieved."));
40+
+ return reply;
41+
+ }
42+
43+
auto sender = call.getSender();
44+
dnfdaemon::KeyValueMap configuration;

‎SPECS/dnf5/CVE-2024-2746.patch‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
From 07c5770482605ca78aaed41f7224d141c5980de4 Mon Sep 17 00:00:00 2001
2+
From: Marek Blaha <mblaha@redhat.com>
3+
Date: Thu, 21 Mar 2024 08:45:15 +0100
4+
Subject: [PATCH] dnf5daemon: Remove reposdir from allowed config overrides
5+
6+
The option is potentially dangerous and can cause dnf5daemon-server to
7+
block on malicious reposdir.
8+
---
9+
dnf5daemon-server/session.cpp | 1 -
10+
1 file changed, 1 deletion(-)
11+
12+
diff --git a/dnf5daemon-server/session.cpp b/dnf5daemon-server/session.cpp
13+
index b776c44bb..142abedfb 100644
14+
--- a/dnf5daemon-server/session.cpp
15+
+++ b/dnf5daemon-server/session.cpp
16+
@@ -60,7 +60,6 @@ static const std::unordered_set<std::string> ALLOWED_MAIN_CONF_OVERRIDES = {
17+
"obsoletes",
18+
"optional_metadata_types",
19+
"protect_running_kernel",
20+
- "reposdir",
21+
"skip_broken",
22+
"skip_if_unavailable",
23+
"skip_unavailable",

‎SPECS/dnf5/dnf5.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,15 @@
3838
Summary: Command-line package manager
3939
Name: dnf5
4040
Version: %{project_version_major}.%{project_version_minor}.%{project_version_patch}
41-
Release: 1%{?dist}
41+
Release: 2%{?dist}
4242
License: GPL-2.0-or-later
4343
Vendor: Microsoft Corporation
4444
Distribution: Azure Linux
4545
URL: https://github.com/rpm-software-management/dnf5
4646
Source0: %{url}/archive/%{version}/dnf5-%{version}.tar.gz
47+
Patch0: CVE-2024-1929.patch
48+
Patch1: CVE-2024-1930.patch
49+
Patch2: CVE-2024-2746.patch
4750
# ========== build requires ==========
4851
BuildRequires: bash-completion
4952
BuildRequires: cmake
@@ -674,6 +677,9 @@ done
674677

675678

676679
%changelog
680+
* Wed Apr 30 2025 Kanishk Bansal <kanbansal@microsoft.com> - 5.1.11-2
681+
- Patch CVE-2024-1929, CVE-2024-1930, CVE-2024-2746
682+
677683
* Wed Jan 31 2024 Sam Meluch <sammeluch@microsoft.com> - 5.1.11-1
678684
- Update to version 5.1.11
679685
- Merge spec from upstream dnf5 repo

0 commit comments

Comments
 (0)