From e62e7dca1560ea2fd1b3cdd823c7319abff49641 Mon Sep 17 00:00:00 2001 From: Michal Ruprich Date: Wed, 14 Jul 2021 16:24:29 +0200 Subject: [PATCH] Resolves: #1965253 - CVE-2021-28902 libyang: NULL pointer dereference in read_yin_container() Resolves: #1965255 - CVE-2021-28903 libyang: recursive call to lyxml_parse_mem() lead to crash --- libyang-1.0.225-CVE-2021-28902.patch | 66 ++++++++++++++++++++++++++ libyang-1.0.225-CVE-2021-28903.patch | 70 ++++++++++++++++++++++++++++ libyang.spec | 13 ++++-- 3 files changed, 146 insertions(+), 3 deletions(-) create mode 100644 libyang-1.0.225-CVE-2021-28902.patch create mode 100644 libyang-1.0.225-CVE-2021-28903.patch diff --git a/libyang-1.0.225-CVE-2021-28902.patch b/libyang-1.0.225-CVE-2021-28902.patch new file mode 100644 index 0000000..8a09fc5 --- /dev/null +++ b/libyang-1.0.225-CVE-2021-28902.patch @@ -0,0 +1,66 @@ +From a3917d95d516e3de267d3cfa5d4d3715a90e8777 Mon Sep 17 00:00:00 2001 +From: Michal Vasko +Date: Mon, 8 Mar 2021 14:08:05 +0100 +Subject: [PATCH] yin parser BUGFIX invalid memory access + +... in case there were some unresolved +extensions. +Fixes #1454 +Fixes #1455 +--- + src/parser_yin.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/src/parser_yin.c b/src/parser_yin.c +index 275991644..256325415 100644 +--- a/src/parser_yin.c ++++ b/src/parser_yin.c +@@ -4572,7 +4572,7 @@ read_yin_anydata(struct lys_module *module, struct lys_node *parent, struct lyxm + + for (r = 0; r < retval->ext_size; ++r) { + /* set flag, which represent LYEXT_OPT_VALID */ +- if (retval->ext[r]->flags & LYEXT_OPT_VALID) { ++ if (retval->ext[r] && (retval->ext[r]->flags & LYEXT_OPT_VALID)) { + retval->flags |= LYS_VALID_EXT; + break; + } +@@ -4794,7 +4794,7 @@ read_yin_leaf(struct lys_module *module, struct lys_node *parent, struct lyxml_e + + for (r = 0; r < retval->ext_size; ++r) { + /* set flag, which represent LYEXT_OPT_VALID */ +- if (retval->ext[r]->flags & LYEXT_OPT_VALID) { ++ if (retval->ext[r] && (retval->ext[r]->flags & LYEXT_OPT_VALID)) { + retval->flags |= LYS_VALID_EXT; + break; + } +@@ -5108,7 +5108,7 @@ read_yin_leaflist(struct lys_module *module, struct lys_node *parent, struct lyx + + for (r = 0; r < retval->ext_size; ++r) { + /* set flag, which represent LYEXT_OPT_VALID */ +- if (retval->ext[r]->flags & LYEXT_OPT_VALID) { ++ if (retval->ext[r] && (retval->ext[r]->flags & LYEXT_OPT_VALID)) { + retval->flags |= LYS_VALID_EXT; + break; + } +@@ -5477,7 +5477,7 @@ read_yin_list(struct lys_module *module, struct lys_node *parent, struct lyxml_e + + for (r = 0; r < retval->ext_size; ++r) { + /* set flag, which represent LYEXT_OPT_VALID */ +- if (retval->ext[r]->flags & LYEXT_OPT_VALID) { ++ if (retval->ext[r] && (retval->ext[r]->flags & LYEXT_OPT_VALID)) { + retval->flags |= LYS_VALID_EXT; + if (retval->ext[r]->flags & LYEXT_OPT_VALID_SUBTREE) { + retval->flags |= LYS_VALID_EXT_SUBTREE; +@@ -5701,8 +5701,9 @@ read_yin_container(struct lys_module *module, struct lys_node *parent, struct ly + } + + for (r = 0; r < retval->ext_size; ++r) { +- /* set flag, which represent LYEXT_OPT_VALID */ +- if (retval->ext[r]->flags & LYEXT_OPT_VALID) { ++ /* extension instance may not yet be resolved */ ++ if (retval->ext[r] && (retval->ext[r]->flags & LYEXT_OPT_VALID)) { ++ /* set flag, which represent LYEXT_OPT_VALID */ + retval->flags |= LYS_VALID_EXT; + if (retval->ext[r]->flags & LYEXT_OPT_VALID_SUBTREE) { + retval->flags |= LYS_VALID_EXT_SUBTREE; + diff --git a/libyang-1.0.225-CVE-2021-28903.patch b/libyang-1.0.225-CVE-2021-28903.patch new file mode 100644 index 0000000..4fa14b4 --- /dev/null +++ b/libyang-1.0.225-CVE-2021-28903.patch @@ -0,0 +1,70 @@ +From 298b30ea4ebee137226acf9bb38678bd82704582 Mon Sep 17 00:00:00 2001 +From: Michal Vasko +Date: Mon, 8 Mar 2021 14:32:58 +0100 +Subject: [PATCH] common FEATURE add a hard limit for recursion + +Fixes #1453 +--- + src/common.h.in | 3 +++ + src/xml.c | 12 +++++++++--- + 2 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/common.h.in b/src/common.h.in +index a5bf2b038..624beba9f 100644 +--- a/src/common.h.in ++++ b/src/common.h.in +@@ -53,6 +53,9 @@ + /* how many bytes add when enlarging buffers */ + #define LY_BUF_STEP 128 + ++/* hard limit on recursion for cases with theoretical unlimited recursion */ ++#define LY_RECURSION_LIMIT 10000 ++ + /* internal logging options */ + enum int_log_opts { + ILO_LOG = 0, /* log normally */ +diff --git a/src/xml.c b/src/xml.c +index 1bc4fdfa5..7e4760976 100644 +--- a/src/xml.c ++++ b/src/xml.c +@@ -943,7 +943,8 @@ parse_attr(struct ly_ctx *ctx, const char *data, unsigned int *len, struct lyxml + + /* logs directly */ + struct lyxml_elem * +-lyxml_parse_elem(struct ly_ctx *ctx, const char *data, unsigned int *len, struct lyxml_elem *parent, int options) ++lyxml_parse_elem(struct ly_ctx *ctx, const char *data, unsigned int *len, struct lyxml_elem *parent, int options, ++ int bt_count) + { + const char *c = data, *start, *e; + const char *lws; /* leading white space for handling mixed content */ +@@ -958,6 +959,11 @@ lyxml_parse_elem(struct ly_ctx *ctx, const char *data, unsigned int *len, struct + + *len = 0; + ++ if (bt_count > LY_RECURSION_LIMIT) { ++ LOGVAL(ctx, LYE_XML_INVAL, LY_VLOG_NONE, NULL, "Recursion limit %d reached", LY_RECURSION_LIMIT); ++ return NULL; ++ } ++ + if (*c != '<') { + return NULL; + } +@@ -1141,7 +1147,7 @@ lyxml_parse_elem(struct ly_ctx *ctx, const char *data, unsigned int *len, struct + lyxml_add_child(ctx, elem, child); + elem->flags |= LYXML_ELEM_MIXED; + } +- child = lyxml_parse_elem(ctx, c, &size, elem, options); ++ child = lyxml_parse_elem(ctx, c, &size, elem, options, bt_count + 1); + if (!child) { + goto error; + } +@@ -1295,7 +1301,7 @@ lyxml_parse_mem(struct ly_ctx *ctx, const char *data, int options) + } + } + +- root = lyxml_parse_elem(ctx, c, &len, NULL, options); ++ root = lyxml_parse_elem(ctx, c, &len, NULL, options, 0); + if (!root) { + goto error; + } else if (!first) { + diff --git a/libyang.spec b/libyang.spec index 12818ab..6900339 100644 --- a/libyang.spec +++ b/libyang.spec @@ -8,13 +8,15 @@ Name: libyang Version: 1.0.225 -Release: 2%{?dist} +Release: 3%{?dist} Summary: YANG data modeling language library Url: https://github.com/CESNET/libyang Source: %{url}/archive/v%{version}.tar.gz License: BSD Patch0: libyang-1.0.184-doc.patch +Patch1: libyang-1.0.225-CVE-2021-28902.patch +Patch2: libyang-1.0.225-CVE-2021-28903.patch Requires: pcre BuildRequires: cmake @@ -29,7 +31,8 @@ BuildRequires: python3-devel BuildRequires: flex BuildRequires: bison BuildRequires: graphviz -BuildRequires: make +BuildRequires: make +BuildRequires: git-core %package devel Summary: Development files for libyang @@ -75,7 +78,7 @@ Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. %prep -%autosetup +%autosetup -S git %build %cmake \ @@ -138,6 +141,10 @@ cp -r doc/html %{buildroot}/%{_docdir}/libyang/html %{python3_sitearch}/__pycache__/yang* %changelog +* Wed Jun 30 2021 Michal Ruprich - 1.0.225-3 +- Resolves: #1965253 - CVE-2021-28902 libyang: NULL pointer dereference in read_yin_container() +- Resolves: #1965255 - CVE-2021-28903 libyang: recursive call to lyxml_parse_mem() lead to crash + * Fri Apr 16 2021 Mohan Boddu - 1.0.225-2 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937