GNU bug report logs

#70581 PHP, glibc, and CVE-2024-2961

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Reply or subscribe to this bug. View this bug as an mbox, status mbox, or maintainer mbox

Report forwarded to bug-guix@gnu.org:
bug#70581; Package guix. (Fri, 26 Apr 2024 06:46:08 GMT) (full text, mbox, link).


Acknowledgement sent to "McSinyx" <cnx@loang.net>:
New bug report received and forwarded. Copy sent to bug-guix@gnu.org. (Fri, 26 Apr 2024 06:46:09 GMT) (full text, mbox, link).


Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: "McSinyx" <cnx@loang.net>
To: <bug-guix@gnu.org>
Subject: PHP, glibc, and CVE-2024-2961
Date: Fri, 26 Apr 2024 15:44:50 +0900
Hello Guix,

Last week, an overflow bug in glibc's iconv(3) was discovered:
https://www.openwall.com/lists/oss-security/2024/04/17/9

It may enable remove code execution through PHP.  Due to
the immutable nature of Guix, is it possible to hotpatch
this using graft, or do we need to rebuild to world?
https://rockylinux.org/news/glibc-vulnerability-april-2024/

Kind regards,
McSinyx




Information forwarded to bug-guix@gnu.org:
bug#70581; Package guix. (Fri, 26 Apr 2024 07:22:11 GMT) (full text, mbox, link).


Message #8 received at 70581@debbugs.gnu.org (full text, mbox, reply):

From: Liliana Marie Prikler <liliana.prikler@ist.tugraz.at>
To: McSinyx <cnx@loang.net>, 70581@debbugs.gnu.org
Cc: guix-security@gnu.org
Subject: Re: PHP, glibc, and CVE-2024-2961
Date: Fri, 26 Apr 2024 09:20:53 +0200
Hi McSinyx,

security-relevant bugs ought to go to <guix-security@gnu.org>, see [1].
Since a patch exists for glibc all the way back to 2.30, I suppose a
graft can be used and should be performed timely. 

Cheers

[1] https://guix.gnu.org/en/security/





Added tag(s) security. Request was from Ludovic Courtès <ludo@gnu.org> to control@debbugs.gnu.org. (Sat, 25 May 2024 09:13:01 GMT) (full text, mbox, link).


Information forwarded to cnx@loang.net, liliana.prikler@ist.tugraz.at, ludo@gnu.org, andreas@enge.fr, janneke@gnu.org, bug-guix@gnu.org:
bug#70581; Package guix. (Sat, 14 Dec 2024 14:23:01 GMT) (full text, mbox, link).


Message #13 received at 70581@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 70581@debbugs.gnu.org
Cc: Maxim Cournoyer <maxim.cournoyer@gmail.com>, guix-security@gnu.org
Subject: [PATCH] gnu: glibc: Graft with fix for CVE-2024-2961.
Date: Sat, 14 Dec 2024 23:20:53 +0900
* gnu/packages/base.scm (%glibc-patches): New variable.
(glibc) [source]: Use it.
[properties]: Mark CVE-2024-2961 as hidden (resolved).
[replacement]: Add field to graft with...
(glibc/fixed): ... this new package.

Fixes: <https://issues.guix.gnu.org/70581>
Change-Id: I6dd70b0e157283925824348f180c466c2f6387c9
---
 gnu/packages/base.scm | 55 ++++++++++++++++++++++++++++++++-----------
 1 file changed, 41 insertions(+), 14 deletions(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index b3f54798c4..a060ed556d 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -878,6 +878,21 @@ (define* (make-ld-wrapper name #:key
     (home-page "https://www.gnu.org/software/guix//")
     (license gpl3+)))
 
+(define %glibc-patches
+  (list "glibc-2.39-git-updates.patch"
+        "glibc-ldd-powerpc.patch"
+        "glibc-2.38-ldd-x86_64.patch"
+        "glibc-dl-cache.patch"
+        "glibc-2.37-versioned-locpath.patch"
+        ;; "glibc-allow-kernel-2.6.32.patch"
+        "glibc-reinstate-prlimit64-fallback.patch"
+        "glibc-supported-locales.patch"
+        "glibc-2.37-hurd-clock_t_centiseconds.patch"
+        "glibc-2.37-hurd-local-clock_gettime_MONOTONIC.patch"
+        "glibc-hurd-mach-print.patch"
+        "glibc-hurd-gettyent.patch"
+        "glibc-hurd-getauxval.patch"))
+
 (define-public glibc
   ;; This is the GNU C Library, used on GNU/Linux and GNU/Hurd.  Prior to
   ;; version 2.28, GNU/Hurd used a different glibc branch.
@@ -890,21 +905,11 @@ (define-public glibc
             (sha256
              (base32
               "09nrwb0ksbah9k35jchd28xxp2hidilqdgz7b8v5f30pz1yd8yzp"))
-            (patches (search-patches "glibc-2.39-git-updates.patch"
-                                     "glibc-ldd-powerpc.patch"
-                                     "glibc-2.38-ldd-x86_64.patch"
-                                     "glibc-dl-cache.patch"
-                                     "glibc-2.37-versioned-locpath.patch"
-                                     ;; "glibc-allow-kernel-2.6.32.patch"
-                                     "glibc-reinstate-prlimit64-fallback.patch"
-                                     "glibc-supported-locales.patch"
-                                     "glibc-2.37-hurd-clock_t_centiseconds.patch"
-                                     "glibc-2.37-hurd-local-clock_gettime_MONOTONIC.patch"
-                                     "glibc-hurd-mach-print.patch"
-                                     "glibc-hurd-gettyent.patch"
-                                     "glibc-hurd-getauxval.patch"))))
-   (properties `((lint-hidden-cve . ("CVE-2024-33601" "CVE-2024-33602"
+            (patches (map search-patch %glibc-patches))))
+   (properties `((lint-hidden-cve . ("CVE-2024-2961"
+                                     "CVE-2024-33601" "CVE-2024-33602"
                                      "CVE-2024-33600" "CVE-2024-33599"))))
+   (replacement glibc/fixed)
    (build-system gnu-build-system)
 
    ;; Glibc's <limits.h> refers to <linux/limit.h>, for instance, so glibc
@@ -1182,6 +1187,28 @@ (define-public glibc
    (license lgpl2.0+)
    (home-page "https://www.gnu.org/software/libc/")))
 
+(define glibc/fixed
+  (package
+    (inherit glibc)
+    (name "glibc")
+    (version (package-version glibc))
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "git://sourceware.org/git/glibc.git")
+                    ;; This is the latest commit from the
+                    ;; 'release/2.39/master' branch, where CVEs and other
+                    ;; important bug fixes are cherry picked.
+                    (commit "2c882bf9c15d206aaf04766d1b8e3ae5b1002cc2")))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "111yf24g0qcfcxywfzrilmjxysahlbkzxfimcz9rq8p00qzvvf51"))
+              (patches (map search-patch
+                            (fold (cut delete <...>)
+                                  %glibc-patches
+                                  '("glibc-2.39-git-updates.patch"))))))))
+
 ;; Define a variation of glibc which uses the default /etc/ld.so.cache, useful
 ;; in FHS containers.
 (define-public glibc-for-fhs

base-commit: 93e1586116f39a30ba1fcb67bd839a43533dfaf4
-- 
2.46.0





Reply sent to Maxim Cournoyer <maxim.cournoyer@gmail.com>:
You have taken responsibility. (Wed, 18 Dec 2024 07:33:01 GMT) (full text, mbox, link).


Notification sent to "McSinyx" <cnx@loang.net>:
bug acknowledged by developer. (Wed, 18 Dec 2024 07:33:02 GMT) (full text, mbox, link).


Message #18 received at 70581-done@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 70581-done@debbugs.gnu.org
Cc: Ludovic Courtès <ludo@gnu.org>, guix-security@gnu.org, Liliana Marie Prikler <liliana.prikler@ist.tugraz.at>, Andreas Enge <andreas@enge.fr>, McSinyx <cnx@loang.net>, Janneke Nieuwenhuizen <janneke@gnu.org>
Subject: Re: bug#70581: PHP, glibc, and CVE-2024-2961
Date: Wed, 18 Dec 2024 16:31:37 +0900
Hi

Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:

> * gnu/packages/base.scm (%glibc-patches): New variable.
> (glibc) [source]: Use it.
> [properties]: Mark CVE-2024-2961 as hidden (resolved).
> [replacement]: Add field to graft with...
> (glibc/fixed): ... this new package.
>
> Fixes: <https://issues.guix.gnu.org/70581>
> Change-Id: I6dd70b0e157283925824348f180c466c2f6387c9

Applied.

-- 
Thanks,
Maxim




Information forwarded to bug-guix@gnu.org:
bug#70581; Package guix. (Wed, 18 Dec 2024 10:09:02 GMT) (full text, mbox, link).


Message #21 received at 70581@debbugs.gnu.org (full text, mbox, reply):

From: Ludovic Courtès <ludo@gnu.org>
To: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Cc: guix-security@gnu.org, Liliana Marie Prikler <liliana.prikler@ist.tugraz.at>, Andreas Enge <andreas@enge.fr>, 70581@debbugs.gnu.org, McSinyx <cnx@loang.net>, Janneke Nieuwenhuizen <janneke@gnu.org>
Subject: Re: bug#70581: PHP, glibc, and CVE-2024-2961
Date: Wed, 18 Dec 2024 11:07:48 +0100
Hi,

Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> * gnu/packages/base.scm (%glibc-patches): New variable.
> (glibc) [source]: Use it.
> [properties]: Mark CVE-2024-2961 as hidden (resolved).
> [replacement]: Add field to graft with...
> (glibc/fixed): ... this new package.
>
> Fixes: <https://issues.guix.gnu.org/70581>
> Change-Id: I6dd70b0e157283925824348f180c466c2f6387c9

I’m late to the party, apologies! (I was Cc’d, despite being on
‘core-packages’, weird.)

> +              (patches (map search-patch
> +                            (fold (cut delete <...>)
> +                                  %glibc-patches
> +                                  '("glibc-2.39-git-updates.patch"))))))))

Or: (delete "glibc-2.39-git-updates.patch" (search-patches %glibc-patches)).

Thank you!

Ludo’.




Information forwarded to bug-guix@gnu.org:
bug#70581; Package guix. (Thu, 19 Dec 2024 02:28:01 GMT) (full text, mbox, link).


Message #24 received at 70581@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: Ludovic Courtès <ludo@gnu.org>
Cc: guix-security@gnu.org, Liliana Marie Prikler <liliana.prikler@ist.tugraz.at>, Andreas Enge <andreas@enge.fr>, 70581@debbugs.gnu.org, McSinyx <cnx@loang.net>, Janneke Nieuwenhuizen <janneke@gnu.org>
Subject: Re: bug#70581: PHP, glibc, and CVE-2024-2961
Date: Thu, 19 Dec 2024 11:25:53 +0900
Hi Ludovic,

Ludovic Courtès <ludo@gnu.org> writes:

[...]

>> +              (patches (map search-patch
>> +                            (fold (cut delete <...>)
>> +                                  %glibc-patches
>> +                                  '("glibc-2.39-git-updates.patch"))))))))
>
> Or: (delete "glibc-2.39-git-updates.patch" (search-patches %glibc-patches)).

It doesn't seem to work the way you'd intuitively expect, because
search-patches is syntax, and %glibc-patches is a list.  So you at least
need the map and search-patch procedure:

--8<---------------cut here---------------start------------->8---
(delete "glibc-2.39-git-updates.patch" (map search-patch %glibc-patches)).
--8<---------------cut here---------------end--------------->8---

And then the delete has no effect because 'search-path' returns absolute
paths, so the patch to delete is now something like
'/home/maxim/src/guix/gnu/packages/patches/glibc-2.39-git-updates.patch',
for example.

-- 
Thanks,
Maxim




Information forwarded to bug-guix@gnu.org:
bug#70581; Package guix. (Fri, 20 Dec 2024 07:56:01 GMT) (full text, mbox, link).


Message #27 received at 70581@debbugs.gnu.org (full text, mbox, reply):

From: Liliana Prikler <liliana.prikler@tugraz.at>
To: Maxim Cournoyer <maxim.cournoyer@gmail.com>, Ludovic Courtès <ludo@gnu.org>
Cc: Andreas Enge <andreas@enge.fr>, Janneke Nieuwenhuizen <janneke@gnu.org>, 70581@debbugs.gnu.org, McSinyx <cnx@loang.net>, guix-security@gnu.org
Subject: Re: bug#70581: PHP, glibc, and CVE-2024-2961
Date: Fri, 20 Dec 2024 08:00:13 +0100
Am Donnerstag, dem 19.12.2024 um 11:25 +0900 schrieb Maxim Cournoyer:
> Hi Ludovic,
> 
> Ludovic Courtès <ludo@gnu.org> writes:
> 
> [...]
> 
> > > +              (patches (map search-patch
> > > +                            (fold (cut delete <...>)
> > > +                                  %glibc-patches
> > > +                                  '("glibc-2.39-git-
> > > updates.patch"))))))))
> > 
> > Or: (delete "glibc-2.39-git-updates.patch" (search-patches %glibc-
> > patches)).
> 
> It doesn't seem to work the way you'd intuitively expect, because
> search-patches is syntax, and %glibc-patches is a list.  So you at
> least need the map and search-patch procedure:
> 
> --8<---------------cut here---------------start------------->8---
> (delete "glibc-2.39-git-updates.patch" (map search-patch %glibc-
> patches)).
> --8<---------------cut here---------------end--------------->8---
> 
> And then the delete has no effect because 'search-path' returns
> absolute paths, so the patch to delete is now something like
> '/home/maxim/src/guix/gnu/packages/patches/glibc-2.39-git-
> updates.patch', for example.
What about 
  (map search-patch 
    (delete "glibc-2.39-git-updates.patch" %glibc-patches)) 
?




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 12:36:12 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.