Skip to content

Commit f619b67

Browse files
[AUTO-CHERRYPICK] Patch cmake for CVE-2023-28320 - branch main (#10137)
Co-authored-by: joejoew <111843948+joejoew@users.noreply.github.com>
1 parent bf54124 commit f619b67

4 files changed

Lines changed: 87 additions & 5 deletions

File tree

SPECS/cmake/CVE-2023-28320.patch

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
From def1a172f3a5ac13c3cd5687d2a352262b02e358 Mon Sep 17 00:00:00 2001
2+
From: Zhichun Wan <zhichunwan@microsoft.com>
3+
Date: Fri, 26 Jul 2024 22:30:10 +0000
4+
Subject: [PATCH] patches
5+
6+
---
7+
Utilities/cmcurl/lib/hostip.c | 19 +++++++++++++++----
8+
1 file changed, 15 insertions(+), 4 deletions(-)
9+
10+
diff --git a/Utilities/cmcurl/lib/hostip.c b/Utilities/cmcurl/lib/hostip.c
11+
index e0e3cfc2..a763ad84 100644
12+
--- a/Utilities/cmcurl/lib/hostip.c
13+
+++ b/Utilities/cmcurl/lib/hostip.c
14+
@@ -72,12 +72,19 @@
15+
#include <SystemConfiguration/SCDynamicStoreCopySpecific.h>
16+
#endif
17+
18+
-#if defined(CURLRES_SYNCH) && \
19+
- defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
20+
+#if defined(CURLRES_SYNCH) && \
21+
+ defined(HAVE_ALARM) && \
22+
+ defined(SIGALRM) && \
23+
+ defined(HAVE_SIGSETJMP) && \
24+
+ defined(GLOBAL_INIT_IS_THREADSAFE)
25+
/* alarm-based timeouts can only be used with all the dependencies satisfied */
26+
#define USE_ALARM_TIMEOUT
27+
#endif
28+
29+
+#ifdef USE_ALARM_TIMEOUT
30+
+#include "easy_lock.h"
31+
+#endif
32+
+
33+
#define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
34+
35+
/*
36+
@@ -249,11 +256,12 @@ void Curl_hostcache_prune(struct Curl_easy *data)
37+
Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
38+
}
39+
40+
-#ifdef HAVE_SIGSETJMP
41+
+#ifdef USE_ALARM_TIMEOUT
42+
/* Beware this is a global and unique instance. This is used to store the
43+
return address that we can jump back to from inside a signal handler. This
44+
is not thread-safe stuff. */
45+
sigjmp_buf curl_jmpenv;
46+
+curl_simple_lock curl_jmpenv_lock;
47+
#endif
48+
49+
/* lookup address, returns entry if found and not stale */
50+
@@ -640,7 +648,6 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
51+
static
52+
void alarmfunc(int sig)
53+
{
54+
- /* this is for "-ansi -Wall -pedantic" to stop complaining! (rabe) */
55+
(void)sig;
56+
siglongjmp(curl_jmpenv, 1);
57+
}
58+
@@ -720,6 +727,8 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
59+
This should be the last thing we do before calling Curl_resolv(),
60+
as otherwise we'd have to worry about variables that get modified
61+
before we invoke Curl_resolv() (and thus use "volatile"). */
62+
+ curl_simple_lock_lock(&curl_jmpenv_lock);
63+
+
64+
if(sigsetjmp(curl_jmpenv, 1)) {
65+
/* this is coming from a siglongjmp() after an alarm signal */
66+
failf(data, "name lookup timed out");
67+
@@ -788,6 +797,8 @@ clean_up:
68+
#endif
69+
#endif /* HAVE_SIGACTION */
70+
71+
+ curl_simple_lock_unlock(&curl_jmpenv_lock);
72+
+
73+
/* switch back the alarm() to either zero or to what it was before minus
74+
the time we spent until now! */
75+
if(prev_alarm) {
76+
--
77+
2.39.4
78+

SPECS/cmake/cmake.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 10%{?dist}
5+
Release: 11%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -20,6 +20,7 @@ Patch5: CVE-2023-35945.patch
2020
Patch6: CVE-2023-38545.patch
2121
Patch7: CVE-2023-38546.patch
2222
Patch8: cve-2023-44487.patch
23+
Patch9: CVE-2023-28320.patch
2324
BuildRequires: bzip2
2425
BuildRequires: bzip2-devel
2526
BuildRequires: curl
@@ -85,6 +86,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
8586
%{_prefix}/doc/%{name}-*/*
8687

8788
%changelog
89+
* Fri Jul 26 2024 Zhichun Wan <zhichunwan@microsoft.com> - 3.21.4-11
90+
- Patch CVE-2023-28320.patch
91+
8892
* Thu Oct 19 2023 Dan Streetman <ddstreet@ieee.org> - 3.21.4-10
8993
- Patch vendored nghttp2 for CVE-2023-44487
9094

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-10.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-10.cm2.aarch64.rpm
33+
cmake-3.21.4-11.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-11.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-10.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-10.cm2.x86_64.rpm
34+
cmake-3.21.4-11.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-11.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)