RHEL-38837 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library
Resolves: RHEL-38837
This commit is contained in:
Zdenek Dohnal
parent
4adb529eb7
commit
8c3e8ad395
@ -37,7 +37,7 @@
|
|||||||
Name: ghostscript
|
Name: ghostscript
|
||||||
Summary: Interpreter for PostScript language & PDF
|
Summary: Interpreter for PostScript language & PDF
|
||||||
Version: 9.27
|
Version: 9.27
|
||||||
Release: 12%{?dist}
|
Release: 13%{?dist}
|
||||||
|
|
||||||
License: AGPLv3+
|
License: AGPLv3+
|
||||||
|
|
||||||
@ -113,6 +113,16 @@ Patch020: ghostscript-9.27-CVE-2023-28879.patch
|
|||||||
Patch021: ghostscript-9.27-CVE-2023-38559.patch
|
Patch021: ghostscript-9.27-CVE-2023-38559.patch
|
||||||
Patch022: ghostscript-9.27-CVE-2023-4042.patch
|
Patch022: ghostscript-9.27-CVE-2023-4042.patch
|
||||||
Patch023: ghostscript-9.27-avoid-divide-by-zero-in-devices.patch
|
Patch023: ghostscript-9.27-avoid-divide-by-zero-in-devices.patch
|
||||||
|
# RHEL-38837 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library
|
||||||
|
# the patch is based on upstream code from 9.50, where a new -dSAFER implementation was introduced and
|
||||||
|
# -dSAFER was made default for any gs calls. To do not backport the whole new -dSAFER implementation,
|
||||||
|
# to do not collide with any future backports related with -dSAFER and to do not change the current default
|
||||||
|
# for ghostscript in RHEL 8, only part of the new -dSAFER implementation was backported,
|
||||||
|
# and the several functions, variables and macros prefix was changed to 'opvp' and used only
|
||||||
|
# for OPVP device, which results in changing the default only for this device and fixing the CVE.
|
||||||
|
# Downside of the fix is if someone depends on unsafe settings of driver for OPVP device
|
||||||
|
# (via Postscript code in command -c, via Postscript code in input file), gs will start to fail.
|
||||||
|
Patch024: gs-cve-2024-33871.patch
|
||||||
|
|
||||||
|
|
||||||
# Downstream patches -- these should be always included when doing rebase:
|
# Downstream patches -- these should be always included when doing rebase:
|
||||||
@ -453,6 +463,9 @@ done
|
|||||||
# =============================================================================
|
# =============================================================================
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jun 12 2024 Zdenek Dohnal <zdohnal@redhat.com> - 9.27-13
|
||||||
|
- CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library
|
||||||
|
|
||||||
* Tue Sep 19 2023 Richard Lescak <rlescak@redhat.com> - 9.27-12
|
* Tue Sep 19 2023 Richard Lescak <rlescak@redhat.com> - 9.27-12
|
||||||
- fix to prevent divison by zero in devices
|
- fix to prevent divison by zero in devices
|
||||||
- Resolves: rhbz#2235009
|
- Resolves: rhbz#2235009
|
||||||
|
|||||||
154
gs-cve-2024-33871.patch
Normal file
154
gs-cve-2024-33871.patch
Normal file
@ -0,0 +1,154 @@
|
|||||||
|
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
|
||||||
|
index 55a785e..be77534 100644
|
||||||
|
--- a/Resource/Init/gs_init.ps
|
||||||
|
+++ b/Resource/Init/gs_init.ps
|
||||||
|
@@ -2607,4 +2607,6 @@ WRITESYSTEMDICT {
|
||||||
|
% be 'true' in some cases.
|
||||||
|
userdict /AGM_preserve_spots //false put
|
||||||
|
|
||||||
|
+.opvpactivatepathcontrol
|
||||||
|
+
|
||||||
|
% The interpreter will run the initial procedure (start).
|
||||||
|
diff --git a/base/gslibctx.c b/base/gslibctx.c
|
||||||
|
index 1ed6093..14fb57c 100644
|
||||||
|
--- a/base/gslibctx.c
|
||||||
|
+++ b/base/gslibctx.c
|
||||||
|
@@ -435,3 +435,27 @@ gs_check_file_permission (gs_memory_t *mem, const char *fname, const int len, co
|
||||||
|
}
|
||||||
|
return code;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+void
|
||||||
|
+opvp_activate_path_control(gs_memory_t *mem, int enable)
|
||||||
|
+{
|
||||||
|
+ gs_lib_ctx_core_t *core;
|
||||||
|
+
|
||||||
|
+ if (mem == NULL || mem->gs_lib_ctx == NULL ||
|
||||||
|
+ (core = mem->gs_lib_ctx->core) == NULL)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ core->opvp_path_control_active = enable;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+int
|
||||||
|
+opvp_is_path_control_active(const gs_memory_t *mem)
|
||||||
|
+{
|
||||||
|
+ gs_lib_ctx_core_t *core;
|
||||||
|
+
|
||||||
|
+ if (mem == NULL || mem->gs_lib_ctx == NULL ||
|
||||||
|
+ (core = mem->gs_lib_ctx->core) == NULL)
|
||||||
|
+ return 0;
|
||||||
|
+
|
||||||
|
+ return core->opvp_path_control_active;
|
||||||
|
+}
|
||||||
|
diff --git a/base/gslibctx.h b/base/gslibctx.h
|
||||||
|
index 1481cb5..e4b3924 100644
|
||||||
|
--- a/base/gslibctx.h
|
||||||
|
+++ b/base/gslibctx.h
|
||||||
|
@@ -61,6 +61,8 @@ typedef struct {
|
||||||
|
bool CPSI_mode;
|
||||||
|
int scanconverter;
|
||||||
|
int act_on_uel;
|
||||||
|
+
|
||||||
|
+ int opvp_path_control_active;
|
||||||
|
} gs_lib_ctx_core_t;
|
||||||
|
|
||||||
|
typedef struct gs_lib_ctx_s
|
||||||
|
@@ -167,4 +169,10 @@ int sjpxd_create(gs_memory_t *mem);
|
||||||
|
|
||||||
|
void sjpxd_destroy(gs_memory_t *mem);
|
||||||
|
|
||||||
|
+void
|
||||||
|
+opvp_activate_path_control(gs_memory_t *mem, int enable);
|
||||||
|
+
|
||||||
|
+int
|
||||||
|
+opvp_is_path_control_active(const gs_memory_t *mem);
|
||||||
|
+
|
||||||
|
#endif /* GSLIBCTX_H */
|
||||||
|
diff --git a/contrib/opvp/gdevopvp.c b/contrib/opvp/gdevopvp.c
|
||||||
|
index 9a6b45b..9693673 100644
|
||||||
|
--- a/contrib/opvp/gdevopvp.c
|
||||||
|
+++ b/contrib/opvp/gdevopvp.c
|
||||||
|
@@ -185,7 +185,7 @@ static int opvp_copy_color(gx_device *, const byte *, int, int,
|
||||||
|
static int _get_params(gs_param_list *);
|
||||||
|
static int opvp_get_params(gx_device *, gs_param_list *);
|
||||||
|
static int oprp_get_params(gx_device *, gs_param_list *);
|
||||||
|
-static int _put_params(gs_param_list *);
|
||||||
|
+static int _put_params(gx_device *, gs_param_list *);
|
||||||
|
static int opvp_put_params(gx_device *, gs_param_list *);
|
||||||
|
static int oprp_put_params(gx_device *, gs_param_list *);
|
||||||
|
static int opvp_fill_path(gx_device *, const gs_gstate *, gx_path *,
|
||||||
|
@@ -3039,7 +3039,7 @@ _get_params(gs_param_list *plist)
|
||||||
|
/* vector driver name */
|
||||||
|
pname = "Driver";
|
||||||
|
vdps.data = (byte *)vectorDriver;
|
||||||
|
- vdps.size = (vectorDriver ? strlen(vectorDriver) + 1 : 0);
|
||||||
|
+ vdps.size = (vectorDriver ? strlen(vectorDriver) : 0);
|
||||||
|
vdps.persistent = false;
|
||||||
|
code = param_write_string(plist, pname, &vdps);
|
||||||
|
if (code) ecode = code;
|
||||||
|
@@ -3176,7 +3176,7 @@ oprp_get_params(gx_device *dev, gs_param_list *plist)
|
||||||
|
* put params
|
||||||
|
*/
|
||||||
|
static int
|
||||||
|
-_put_params(gs_param_list *plist)
|
||||||
|
+_put_params(gx_device *dev, gs_param_list *plist)
|
||||||
|
{
|
||||||
|
int code;
|
||||||
|
int ecode = 0;
|
||||||
|
@@ -3198,6 +3198,12 @@ _put_params(gs_param_list *plist)
|
||||||
|
code = param_read_string(plist, pname, &vdps);
|
||||||
|
switch (code) {
|
||||||
|
case 0:
|
||||||
|
+ if (opvp_is_path_control_active(dev->memory)
|
||||||
|
+ && (!vectorDriver || strlen(vectorDriver) != vdps.size
|
||||||
|
+ || memcmp(vectorDriver, vdps.data, vdps.size) != 0)) {
|
||||||
|
+ param_signal_error(plist, pname, gs_error_invalidaccess);
|
||||||
|
+ return_error(gs_error_invalidaccess);
|
||||||
|
+ }
|
||||||
|
buff = realloc(buff, vdps.size + 1);
|
||||||
|
memcpy(buff, vdps.data, vdps.size);
|
||||||
|
buff[vdps.size] = 0;
|
||||||
|
@@ -3399,7 +3405,7 @@ opvp_put_params(gx_device *dev, gs_param_list *plist)
|
||||||
|
int code;
|
||||||
|
|
||||||
|
/* put params */
|
||||||
|
- code = _put_params(plist);
|
||||||
|
+ code = _put_params(dev, plist);
|
||||||
|
if (code) return code;
|
||||||
|
|
||||||
|
/* put default params */
|
||||||
|
@@ -3415,7 +3421,7 @@ oprp_put_params(gx_device *dev, gs_param_list *plist)
|
||||||
|
int code;
|
||||||
|
|
||||||
|
/* put params */
|
||||||
|
- code = _put_params(plist);
|
||||||
|
+ code = _put_params(dev, plist);
|
||||||
|
if (code) return code;
|
||||||
|
|
||||||
|
/* put default params */
|
||||||
|
diff --git a/psi/zfile.c b/psi/zfile.c
|
||||||
|
index 271a1a0..05b8203 100644
|
||||||
|
--- a/psi/zfile.c
|
||||||
|
+++ b/psi/zfile.c
|
||||||
|
@@ -875,6 +875,12 @@ static int zgetfilename(i_ctx_t *i_ctx_p)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int zopvpactivatepathcontrol(i_ctx_t *i_ctx_p)
|
||||||
|
+{
|
||||||
|
+ opvp_activate_path_control(imemory, 1);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* ------ Initialization procedure ------ */
|
||||||
|
|
||||||
|
const op_def zfile_op_defs[] =
|
||||||
|
@@ -893,6 +899,7 @@ const op_def zfile_op_defs[] =
|
||||||
|
{"0%file_continue", file_continue},
|
||||||
|
{"0%execfile_finish", execfile_finish},
|
||||||
|
{"1.getfilename", zgetfilename},
|
||||||
|
+ {"0.opvpactivatepathcontrol", zopvpactivatepathcontrol},
|
||||||
|
op_def_end(0)
|
||||||
|
};
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user