import UBI gnupg2-2.4.5-3.el10_1
This commit is contained in:
parent
e7fd7a2b5b
commit
098b93b0c2
103
gnupg-2.4.5-memcpy.patch
Normal file
103
gnupg-2.4.5-memcpy.patch
Normal file
@ -0,0 +1,103 @@
|
||||
From 115d138ba599328005c5321c0ef9f00355838ca9 Mon Sep 17 00:00:00 2001
|
||||
From: Werner Koch <wk@gnupg.org>
|
||||
Date: Thu, 23 Oct 2025 11:36:04 +0200
|
||||
Subject: [PATCH] gpg: Fix possible memory corruption in the armor parser.
|
||||
|
||||
* g10/armor.c (armor_filter): Fix faulty double increment.
|
||||
|
||||
* common/iobuf.c (underflow_target): Assert that the filter
|
||||
implementations behave well.
|
||||
--
|
||||
|
||||
This fixes a bug in a code path which can only be reached with special
|
||||
crafted input data and would then error out at an upper layer due to
|
||||
corrupt input (every second byte in the buffer is unitialized
|
||||
garbage). No fuzzing has yet hit this case and we don't have a test
|
||||
case for this code path. However memory corruption can never be
|
||||
tolerated as it always has the protential for remode code execution.
|
||||
|
||||
Reported-by: 8b79fe4dd0581c1cd000e1fbecba9f39e16a396a
|
||||
Fixes-commit: c27c7416d5148865a513e007fb6f0a34993a6073
|
||||
which fixed
|
||||
Fixes-commit: 7d0efec7cf5ae110c99511abc32587ff0c45b14f
|
||||
|
||||
The bug was introduced on 1999-01-07 by me:
|
||||
* armor.c: Rewrote large parts.
|
||||
which I fixed on 1999-03-02 but missed to fix the other case:
|
||||
* armor.c (armor_filter): Fixed armor bypassing.
|
||||
|
||||
Below is base64+gzipped test data which can be used with valgrind to
|
||||
show access to uninitalized memory in write(2) in the unpatched code.
|
||||
|
||||
--8<---------------cut here---------------start------------->8---
|
||||
H4sICIDd+WgCA3h4AO3QMQ6CQBCG0djOKbY3G05gscYFSRAJt/AExp6Di0cQG0ze
|
||||
a//MV0zOq3Pt+jFN3ZTKfLvP9ZLafqifJUe8juOjeZbVtSkbRPmRgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
|
||||
gICAgICAgICAgICAgICAgICAgICAgICAgMCXF6dYDgAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7E14AAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwZ94aieId3+8EAA==
|
||||
--8<---------------cut here---------------end--------------->8---
|
||||
---
|
||||
common/iobuf.c | 6 ++++++
|
||||
g10/armor.c | 4 ++--
|
||||
2 files changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/common/iobuf.c b/common/iobuf.c
|
||||
index 8a128b3f6..769df958d 100644
|
||||
--- a/common/iobuf.c
|
||||
+++ b/common/iobuf.c
|
||||
@@ -2043,6 +2043,8 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
|
||||
rc = 0;
|
||||
else
|
||||
{
|
||||
+ size_t tmplen;
|
||||
+
|
||||
/* If no buffered data and drain buffer has been setup, and drain
|
||||
* buffer is largish, read data directly to drain buffer. */
|
||||
if (a->d.len == 0
|
||||
@@ -2056,8 +2058,10 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
|
||||
log_debug ("iobuf-%d.%d: underflow: A->FILTER (%lu bytes, to external drain)\n",
|
||||
a->no, a->subno, (ulong)len);
|
||||
|
||||
+ tmplen = len; /* Used to check for bugs in the filter. */
|
||||
rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
|
||||
a->e_d.buf, &len);
|
||||
+ log_assert (len <= tmplen);
|
||||
a->e_d.used = len;
|
||||
len = 0;
|
||||
}
|
||||
@@ -2067,8 +2071,10 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
|
||||
log_debug ("iobuf-%d.%d: underflow: A->FILTER (%lu bytes)\n",
|
||||
a->no, a->subno, (ulong)len);
|
||||
|
||||
+ tmplen = len;
|
||||
rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
|
||||
&a->d.buf[a->d.len], &len);
|
||||
+ log_assert (len <= tmplen);
|
||||
}
|
||||
}
|
||||
a->d.len += len;
|
||||
diff --git a/g10/armor.c b/g10/armor.c
|
||||
index 036b72772..59a6202aa 100644
|
||||
--- a/g10/armor.c
|
||||
+++ b/g10/armor.c
|
||||
@@ -1312,8 +1312,8 @@ armor_filter( void *opaque, int control,
|
||||
n = 0;
|
||||
if( afx->buffer_len ) {
|
||||
/* Copy the data from AFX->BUFFER to BUF. */
|
||||
- for(; n < size && afx->buffer_pos < afx->buffer_len; n++ )
|
||||
- buf[n++] = afx->buffer[afx->buffer_pos++];
|
||||
+ for(; n < size && afx->buffer_pos < afx->buffer_len;)
|
||||
+ buf[n++] = afx->buffer[afx->buffer_pos++];
|
||||
if( afx->buffer_pos >= afx->buffer_len )
|
||||
afx->buffer_len = 0;
|
||||
}
|
||||
|
||||
15
gnupg2.spec
15
gnupg2.spec
@ -3,7 +3,7 @@
|
||||
Summary: Utility for secure communication and data storage
|
||||
Name: gnupg2
|
||||
Version: 2.4.5
|
||||
Release: 2%{?dist}
|
||||
Release: 3%{?dist}
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT
|
||||
Source0: https://gnupg.org/ftp/gcrypt/%{?pre:alpha/}gnupg/gnupg-%{version}%{?pre}.tar.bz2
|
||||
@ -32,6 +32,8 @@ Patch33: gnupg-2.4.3-restore-systemd-sockets.patch
|
||||
Patch34: gnupg-2.4.5-revert-default-eddsa.patch
|
||||
# https://dev.gnupg.org/T7129
|
||||
Patch35: gnupg-2.4.5-sast.patch
|
||||
# https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9
|
||||
Patch36: gnupg-2.4.5-memcpy.patch
|
||||
|
||||
URL: https://www.gnupg.org/
|
||||
|
||||
@ -67,12 +69,12 @@ BuildRequires: swtpm
|
||||
Requires: libgcrypt >= 1.9.1
|
||||
Requires: libgpg-error >= 1.46
|
||||
|
||||
Recommends: pinentry
|
||||
Suggests: pinentry
|
||||
|
||||
Recommends: gnupg2-smime
|
||||
Suggests: gnupg2-smime
|
||||
|
||||
# for USB smart card support
|
||||
Recommends: pcsc-lite-ccid
|
||||
Suggests: pcsc-lite-ccid
|
||||
|
||||
# pgp-tools, perl-GnuPG-Interface requires 'gpg' (not sure why) -- Rex
|
||||
Provides: gpg = %{version}-%{release}
|
||||
@ -127,6 +129,7 @@ to the base GnuPG package
|
||||
%patch 33 -p1 -b .restore-systemd-sockets
|
||||
%patch 34 -p1 -R -b .eddsa
|
||||
%patch 35 -p1 -b .sast
|
||||
%patch 36 -p1 -b .memcpy
|
||||
|
||||
# pcsc-lite library major: 0 in 1.2.0, 1 in 1.2.9+ (dlopen()'d in pcsc-wrapper)
|
||||
# Note: this is just the name of the default shared lib to load in scdaemon,
|
||||
@ -234,6 +237,10 @@ make -k check
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Jan 13 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.5-3
|
||||
- Fix CVE-2025-68973 (gpg.fail/memcpy)
|
||||
- Avoid weak dependencies
|
||||
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.4.5-2
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
Resolves: RHEL-64018
|
||||
|
||||
Loading…
Reference in New Issue
Block a user