From 63e99e62aff3d6f9b1f4a02ab8d7efe8447e6e0b Mon Sep 17 00:00:00 2001 From: Abhi Das Date: Wed, 13 Sep 2023 22:30:13 -0500 Subject: [PATCH] squashfs-tools: CVE-2021-41072 additional write outside destination directory exploit fix --- .squashfs-tools.metadata | 3 + CVE-2021-41072-c9s-combined.patch | 587 ++++++++++++++++++++++++++++++ squashfs-tools.spec | 8 +- 3 files changed, 597 insertions(+), 1 deletion(-) create mode 100644 .squashfs-tools.metadata create mode 100644 CVE-2021-41072-c9s-combined.patch diff --git a/.squashfs-tools.metadata b/.squashfs-tools.metadata new file mode 100644 index 0000000..488b51b --- /dev/null +++ b/.squashfs-tools.metadata @@ -0,0 +1,3 @@ +ccdbdb36be907de767019f2f35e985c6fad1bc2c 4.4-git.1.tar.gz +35fd7f626fc3259edce72cb0e3f3656a90d1e03f mksquashfs.1 +e9e8ab48d8d38eae19affcd515a94497d21199ac unsquashfs.1 diff --git a/CVE-2021-41072-c9s-combined.patch b/CVE-2021-41072-c9s-combined.patch new file mode 100644 index 0000000..d31fcd4 --- /dev/null +++ b/CVE-2021-41072-c9s-combined.patch @@ -0,0 +1,587 @@ +diff -Nupr a/squashfs-tools/Makefile b/squashfs-tools/Makefile +--- a/squashfs-tools/Makefile 2023-06-26 23:18:33.104153303 -0500 ++++ b/squashfs-tools/Makefile 2023-06-26 23:19:49.230107688 -0500 +@@ -156,8 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o + caches-queues-lists.o + + UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \ +- unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \ +- compressor.o unsquashfs_info.o ++ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o unsquash-12.o \ ++ swap.o compressor.o unsquashfs_info.o + + CFLAGS ?= -O2 + CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \ +@@ -353,6 +353,8 @@ unsquash-34.o: unsquashfs.h unsquash-34. + + unsquash-1234.o: unsquash-1234.c + ++unsquash-12.o: unsquash-12.c unsquashfs.h ++ + unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h + + unsquashfs_info.o: unsquashfs.h squashfs_fs.h +diff -Nupr a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c +--- a/squashfs-tools/unsquash-1234.c 2023-06-26 23:18:33.104153303 -0500 ++++ b/squashfs-tools/unsquash-1234.c 2023-06-26 23:19:49.230107688 -0500 +@@ -25,8 +25,8 @@ + * unsquash-4. + */ + +-#define TRUE 1 +-#define FALSE 0 ++#include "unsquashfs.h" ++ + /* + * Check name for validity, name should not + * - be ".", "./", or +@@ -56,3 +56,40 @@ int check_name(char *name, int size) + + return TRUE; + } ++ ++ ++void squashfs_closedir(struct dir *dir) ++{ ++ struct dir_ent *ent = dir->dirs; ++ ++ while(ent) { ++ struct dir_ent *tmp = ent; ++ ++ ent = ent->next; ++ free(tmp->name); ++ free(tmp); ++ } ++ ++ free(dir); ++} ++ ++ ++/* ++ * Check directory for duplicate names. As the directory should be sorted, ++ * duplicates will be consecutive. Obviously we also need to check if the ++ * directory has been deliberately unsorted, to evade this check. ++ */ ++int check_directory(struct dir *dir) ++{ ++ int i; ++ struct dir_ent *ent; ++ ++ if (dir->dir_count < 2) ++ return TRUE; ++ ++ for (ent = dir->dirs, i = 0; i < dir->dir_count - 1; ent = ent->next, i++) ++ if (strcmp(ent->name, ent->next->name) >= 0) ++ return FALSE; ++ ++ return TRUE; ++} +diff -Nupr a/squashfs-tools/unsquash-12.c b/squashfs-tools/unsquash-12.c +--- a/squashfs-tools/unsquash-12.c 1969-12-31 18:00:00.000000000 -0600 ++++ b/squashfs-tools/unsquash-12.c 2023-06-26 23:19:49.230107688 -0500 +@@ -0,0 +1,103 @@ ++/* ++ * Unsquash a squashfs filesystem. This is a highly compressed read only ++ * filesystem. ++ * ++ * Copyright (c) 2021 ++ * Phillip Lougher ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public License ++ * as published by the Free Software Foundation; either version 2, ++ * or (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program; if not, write to the Free Software ++ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++ * ++ * unsquash-12.c ++ * ++ * Helper functions used by unsquash-1 and unsquash-2. ++ */ ++ ++#include "unsquashfs.h" ++ ++/* ++ * Bottom up linked list merge sort. ++ * ++ */ ++void sort_directory(struct dir *dir) ++{ ++ struct dir_ent *cur, *l1, *l2, *next; ++ int len1, len2, stride = 1; ++ ++ if (dir->dir_count < 2) ++ return; ++ ++ /* ++ * We can consider our linked-list to be made up of stride length ++ * sublists. Each iteration around this loop merges adjacent ++ * stride length sublists into larger 2*stride sublists. We stop ++ * when stride becomes equal to the entire list. ++ * ++ * Initially stride = 1 (by definition a sublist of 1 is sorted), and ++ * these 1 element sublists are merged into 2 element sublists, which ++ * are then merged into 4 element sublists and so on. ++ */ ++ do { ++ l2 = dir->dirs; /* head of current linked list */ ++ cur = NULL; /* empty output list */ ++ ++ /* ++ * Iterate through the linked list, merging adjacent sublists. ++ * On each interation l2 points to the next sublist pair to be ++ * merged (if there's only one sublist left this is simply added ++ * to the output list) ++ */ ++ while (l2) { ++ l1 = l2; ++ for (len1 = 0; l2 && len1 < stride; len1 ++, l2 = l2->next); ++ len2 = stride; ++ ++ /* ++ * l1 points to first sublist. ++ * l2 points to second sublist. ++ * Merge them onto the output list ++ */ ++ while (len1 && l2 && len2) { ++ if(strcmp(l1->name, l2->name) <= 0) { ++ next = l1; ++ l1 = l1->next; ++ len1 --; ++ } else { ++ next = l2; ++ l2 = l2->next; ++ len2 --; ++ } ++ ++ if (cur) { ++ cur->next = next; ++ cur = next; ++ } else ++ dir->dirs = cur = next; ++ } ++ /* ++ * One sublist is now empty, copy the other one onto the ++ * output list ++ */ ++ for (; len1; len1 --, l1 = l1->next) { ++ if(cur) { ++ cur->next = l1; ++ cur = l1; ++ } else ++ dir->dirs = cur = l1; ++ } ++ } ++ cur->next = NULL; ++ stride = stride << 1; ++ } while(stride < dir->dir_count); ++} +diff -Nupr a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c +--- a/squashfs-tools/unsquash-1.c 2023-06-26 23:18:33.104153303 -0500 ++++ b/squashfs-tools/unsquash-1.c 2023-06-26 23:19:49.230107688 -0500 +@@ -207,7 +207,7 @@ static struct dir *squashfs_opendir(unsi + long long start; + int bytes; + int dir_count, size; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -220,7 +220,7 @@ static struct dir *squashfs_opendir(unsi + EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -295,29 +295,36 @@ static struct dir *squashfs_opendir(unsi + TRACE("squashfs_opendir: directory entry %s, inode " + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- EXIT_UNSQUASH("squashfs_opendir: " +- "realloc failed!\n"); +- dir->dirs = new_dir; +- } +- strcpy(dir->dirs[dir->dir_count].name, dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ++ ent = malloc(sizeof(struct dir_ent)); ++ if(ent == NULL) ++ MEM_ERROR(); ++ ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if (cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } + } + ++ /* check directory for duplicate names. Need to sort directory first */ ++ sort_directory(dir); ++ if (check_directory(dir) == FALSE) { ++ ERROR("File system corrupted: directory has duplicate names\n"); ++ goto corrupted; ++ } + return dir; + + corrupted: +- free(dir->dirs); +- free(dir); ++ squashfs_closedir(dir); + return NULL; + } + +diff -Nupr a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c +--- a/squashfs-tools/unsquash-2.c 2023-06-26 23:18:33.104153303 -0500 ++++ b/squashfs-tools/unsquash-2.c 2023-06-26 23:19:49.230107688 -0500 +@@ -29,6 +29,7 @@ static squashfs_fragment_entry_2 *fragme + static unsigned int *uid_table, *guid_table; + static char *inode_table, *directory_table; + static squashfs_operations ops; ++int needs_sorting = FALSE; + + static void read_block_list(unsigned int *block_list, char *block_ptr, int blocks) + { +@@ -308,7 +309,7 @@ static struct dir *squashfs_opendir(unsi + long long start; + int bytes; + int dir_count, size; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -321,7 +322,7 @@ static struct dir *squashfs_opendir(unsi + EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -396,29 +397,41 @@ static struct dir *squashfs_opendir(unsi + TRACE("squashfs_opendir: directory entry %s, inode " + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- EXIT_UNSQUASH("squashfs_opendir: " +- "realloc failed!\n"); +- dir->dirs = new_dir; +- } +- strcpy(dir->dirs[dir->dir_count].name, dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ++ ent = malloc(sizeof(struct dir_ent)); ++ if (ent == NULL) ++ MEM_ERROR(); ++ ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if (cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } + } + ++ if (needs_sorting) ++ sort_directory(dir); ++ ++ /* check directory for duplicate names and sorting */ ++ if (check_directory(dir) == FALSE) { ++ if (needs_sorting) ++ ERROR("File system corrupted: directory has duplicate names\n"); ++ else ++ ERROR("File system corrupted: directory has duplicate names or is unsorted\n"); ++ goto corrupted; ++ } + return dir; + + corrupted: +- free(dir->dirs); +- free(dir); ++ squashfs_closedir(dir); + return NULL; + } + +diff -Nupr a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c +--- a/squashfs-tools/unsquash-3.c 2023-06-26 23:18:33.105153302 -0500 ++++ b/squashfs-tools/unsquash-3.c 2023-06-26 23:19:49.230107688 -0500 +@@ -334,7 +334,7 @@ static struct dir *squashfs_opendir(unsi + long long start; + int bytes; + int dir_count, size; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -347,7 +347,7 @@ static struct dir *squashfs_opendir(unsi + EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -423,29 +423,36 @@ static struct dir *squashfs_opendir(unsi + TRACE("squashfs_opendir: directory entry %s, inode " + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- EXIT_UNSQUASH("squashfs_opendir: " +- "realloc failed!\n"); +- dir->dirs = new_dir; +- } +- strcpy(dir->dirs[dir->dir_count].name, dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ++ ent = malloc(sizeof(struct dir_ent)); ++ if (ent == NULL) ++ MEM_ERROR(); ++ ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if (cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } + } + ++ /* check directory for duplicate names and sorting */ ++ if (check_directory(dir) == FALSE) { ++ ERROR("File system corrupted: directory has duplicate names or is unsorted\n"); ++ goto corrupted; ++ } ++ + return dir; + + corrupted: +- free(dir->dirs); +- free(dir); ++ squashfs_closedir(dir); + return NULL; + } + +diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c +--- a/squashfs-tools/unsquash-4.c 2023-06-26 23:18:33.105153302 -0500 ++++ b/squashfs-tools/unsquash-4.c 2023-06-26 23:19:49.231107688 -0500 +@@ -281,7 +281,7 @@ static struct dir *squashfs_opendir(unsi + long long start; + long long bytes; + int dir_count, size; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -294,7 +294,7 @@ static struct dir *squashfs_opendir(unsi + EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -359,29 +359,36 @@ static struct dir *squashfs_opendir(unsi + TRACE("squashfs_opendir: directory entry %s, inode " + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- EXIT_UNSQUASH("squashfs_opendir: " +- "realloc failed!\n"); +- dir->dirs = new_dir; +- } +- strcpy(dir->dirs[dir->dir_count].name, dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ++ ent = malloc(sizeof(struct dir_ent)); ++ if (ent == NULL) ++ MEM_ERROR(); ++ ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if (cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } + } + ++ /* check directory for duplicate names and sorting */ ++ if (check_directory(dir) == FALSE) { ++ ERROR("File system corrupted: directory has duplicate names or is unsorted\n"); ++ goto corrupted; ++ } ++ + return dir; + + corrupted: +- free(dir->dirs); +- free(dir); ++ squashfs_closedir(dir); + return NULL; + } + +diff -Nupr a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c +--- a/squashfs-tools/unsquashfs.c 2023-06-26 23:18:33.105153302 -0500 ++++ b/squashfs-tools/unsquashfs.c 2023-06-26 23:19:49.231107688 -0500 +@@ -78,6 +78,7 @@ int user_xattrs = FALSE; + int ignore_errors = FALSE; + int strict_errors = FALSE; + int use_localtime = TRUE; ++extern int needs_sorting; + + int lookup_type[] = { + 0, +@@ -1287,26 +1288,23 @@ failed: + int squashfs_readdir(struct dir *dir, char **name, unsigned int *start_block, + unsigned int *offset, unsigned int *type) + { +- if(dir->cur_entry == dir->dir_count) ++ if(dir->cur_entry == NULL) ++ dir->cur_entry = dir->dirs; ++ else ++ dir->cur_entry = dir->cur_entry->next; ++ ++ if (dir->cur_entry == NULL) + return FALSE; + +- *name = dir->dirs[dir->cur_entry].name; +- *start_block = dir->dirs[dir->cur_entry].start_block; +- *offset = dir->dirs[dir->cur_entry].offset; +- *type = dir->dirs[dir->cur_entry].type; +- dir->cur_entry ++; ++ *name = dir->cur_entry->name; ++ *start_block = dir->cur_entry->start_block; ++ *offset = dir->cur_entry->offset; ++ *type = dir->cur_entry->type; + + return TRUE; + } + + +-void squashfs_closedir(struct dir *dir) +-{ +- free(dir->dirs); +- free(dir); +-} +- +- + char *get_component(char *target, char **targname) + { + char *start; +@@ -1959,6 +1957,10 @@ int read_super(char *source) + * 1.x, 2.x and 3.x filesystems use gzip compression. + */ + comp = lookup_compressor("gzip"); ++ ++ if (sBlk_3.s_minor == 0) ++ needs_sorting = TRUE; ++ + return TRUE; + + failed_mount: +diff -Nupr a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h +--- a/squashfs-tools/unsquashfs.h 2023-06-26 23:18:33.106153301 -0500 ++++ b/squashfs-tools/unsquashfs.h 2023-06-26 23:19:49.231107688 -0500 +@@ -165,21 +165,22 @@ struct queue { + #define DIR_ENT_SIZE 16 + + struct dir_ent { +- char name[SQUASHFS_NAME_LEN + 1]; ++ char *name; + unsigned int start_block; + unsigned int offset; + unsigned int type; ++ struct dir_ent *next; + }; + + struct dir { + int dir_count; +- int cur_entry; + unsigned int mode; + uid_t uid; + gid_t guid; + unsigned int mtime; + unsigned int xattr; + struct dir_ent *dirs; ++ struct dir_ent *cur_entry; + }; + + struct file_entry { +@@ -264,4 +265,9 @@ extern long long *alloc_index_table(int) + + /* unsquash-1234.c */ + extern int check_name(char *, int); ++extern void squashfs_closedir(struct dir *); ++extern int check_directory(struct dir *); ++ ++/* unsquash-12.c */ ++extern void sort_directory(struct dir *); + #endif diff --git a/squashfs-tools.spec b/squashfs-tools.spec index 12dfff5..61de089 100644 --- a/squashfs-tools.spec +++ b/squashfs-tools.spec @@ -2,7 +2,7 @@ Summary: Utility for the creation of squashfs filesystems %global forgeurl https://github.com/plougher/squashfs-tools Version: 4.4 Name: squashfs-tools -Release: 9.git1%{?dist} +Release: 10.git1%{?dist} License: GPLv2+ URL: %{forgeurl}/archive/4.4-git.1.tar.gz Source: 4.4-git.1.tar.gz @@ -13,6 +13,7 @@ Source2: unsquashfs.1 Patch0: bz2023218.patch Patch1: bz2000638.patch +Patch2: CVE-2021-41072-c9s-combined.patch BuildRequires: make BuildRequires: gcc @@ -31,6 +32,7 @@ contains the utilities for manipulating squashfs filesystems. %setup -n %{name}-4.4-git.1 %patch0 -p1 %patch1 -p1 +%patch2 -p1 %build %set_build_flags @@ -54,6 +56,10 @@ install -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man1/unsquashfs.1 %{_sbindir}/unsquashfs %changelog +* Wed Sep 13 2023 Abhi Das - 4.4-10.git1 +- CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix + rhbz#2007304 + * Mon May 30 2022 Abhi Das - 4.4-9.git1 - CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination rhbz#2000638