[Buildroot] [PATCH 2025.02.x RESEND 3/5] package/busybox: patch CVE-2023-39810
Thomas Perale via buildroot <[email protected]>
| Newsgroups | net.busybox.buildroot |
|---|---|
| Message-ID | <[email protected]> |
Based on the work of the Debian community, this commit patches the
following vulnerability.
- CVE-2023-39810:
An issue in the CPIO command of Busybox v1.33.2 allows attackers to
execute a directory traversal.
For more information, see:
- https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/archival-disallow-path-traversals-CVE-2023-39810.patch
- https://www.cve.org/CVERecord?id=CVE-2023-39810
Signed-off-by: Thomas Perale <[email protected]>
---
...allow-path-traversals-CVE-2023-39810.patch | 126 ++++++++++++++++++
package/busybox/busybox.mk | 3 +
2 files changed, 129 insertions(+)
create mode 100644 package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
diff --git a/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch b/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
new file mode 100644
index 0000000000..cea4e7de9a
--- /dev/null
+++ b/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
@@ -0,0 +1,126 @@
+Commit-ID: 9a8796436b9b0641e13480811902ea2ac57881d3
+From: Denys Vlasenko <[email protected]>
+Date: Wed, 2 Oct 2024 10:12:05 +0200
+Subject: archival: disallow path traversals (CVE-2023-39810)
+Origin: upstream, https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3
+Forwarded: not-needed
+Bug-Debian: https://bugs.debian.org/1055307
+
+Create new configure option for archival/libarchive based extractions to
+disallow path traversals.
+As this is a paranoid option and might introduce backward
+incompatibility, default it to no.
+
+Based on the patch by Peter Kaestle <[email protected]>
+
+function old new delta
+data_extract_all 921 945 +24
+strip_unsafe_prefix 101 102 +1
+------------------------------------------------------------------------------
+(add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0) Total: 25 bytes
+
+Signed-off-by: Denys Vlasenko <[email protected]>
+CVE: CVE-2023-39810
+Upstream: https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/archival-disallow-path-traversals-CVE-2023-39810.patch
+Signed-off-by: Thomas Perale <[email protected]>
+---
+ archival/Config.src | 11 +++++++++++
+ archival/libarchive/data_extract_all.c | 8 ++++++++
+ archival/libarchive/unsafe_prefix.c | 6 +++++-
+ scripts/kconfig/lxdialog/check-lxdialog.sh | 2 +-
+ testsuite/cpio.tests | 23 ++++++++++++++++++++++
+ 5 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/archival/Config.src b/archival/Config.src
+index 6f4f30c43..cbcd7217c 100644
+--- a/archival/Config.src
++++ b/archival/Config.src
+@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST
+ This option reduces decompression time by about 25% at the cost of
+ a 1K bigger binary.
+
++config FEATURE_PATH_TRAVERSAL_PROTECTION
++ bool "Prevent extraction of filenames with /../ path component"
++ default n
++ help
++ busybox tar and unzip remove "PREFIX/../" (if it exists)
++ from extracted names.
++ This option enables this behavior for all other unpacking applets,
++ such as cpio, ar, rpm.
++ GNU cpio 2.15 has NO such sanity check.
++# try other archivers and document their behavior?
++
+ endmenu
+diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
+index 049c2c156..8a69711c1 100644
+--- a/archival/libarchive/data_extract_all.c
++++ b/archival/libarchive/data_extract_all.c
+@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
+ } while (--n != 0);
+ }
+ #endif
++#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
++ /* Strip leading "/" and up to last "/../" path component */
++ dst_name = (char *)strip_unsafe_prefix(dst_name);
++#endif
++// ^^^ This may be a problem if some applets do need to extract absolute names.
++// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
++// You might think that rpm needs it, but in my tests rpm's internal cpio
++// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO".
+
+ if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) {
+ char *slash = strrchr(dst_name, '/');
+diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
+index 33e487bf9..667081195 100644
+--- a/archival/libarchive/unsafe_prefix.c
++++ b/archival/libarchive/unsafe_prefix.c
+@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+ cp++;
+ continue;
+ }
+- if (is_prefixed_with(cp, "/../"+1)) {
++ /* We are called lots of times.
++ * is_prefixed_with(cp, "../") is slower than open-coding it,
++ * with minimal code growth (~few bytes).
++ */
++ if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') {
+ cp += 3;
+ continue;
+ }
+diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests
+index 85e746589..a4462c53e 100755
+--- a/testsuite/cpio.tests
++++ b/testsuite/cpio.tests
+@@ -154,6 +154,29 @@ testing "cpio -R with extract" \
+ " "" ""
+ SKIP=
+
++# Create an archive containing a file with "../dont_write" filename.
++# See that it will not be allowed to unpack.
++# NB: GNU cpio 2.15 DOES NOT do such checks.
++optional FEATURE_PATH_TRAVERSAL_PROTECTION
++rm -rf cpio.testdir
++mkdir -p cpio.testdir/prepare/inner
++echo "file outside of destination was written" > cpio.testdir/prepare/dont_write
++echo "data" > cpio.testdir/prepare/inner/to_extract
++mkdir -p cpio.testdir/extract
++testing "cpio extract file outside of destination" "\
++(cd cpio.testdir/prepare/inner && $ECHO -e '../dont_write\nto_extract' | cpio -o -H newc) | (cd cpio.testdir/extract && cpio -vi 2>&1)
++echo \$?
++ls cpio.testdir/dont_write 2>&1" \
++"\
++cpio: removing leading '../' from member names
++../dont_write
++to_extract
++1 blocks
++0
++ls: cpio.testdir/dont_write: No such file or directory
++" "" ""
++SKIP=
++
+ # Clean up
+ rm -rf cpio.testdir cpio.testdir2 2>/dev/null
+
+--
+2.47.2
+
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 0488518086..91d3b69139 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0008-awk.c-fix-CVE-2023-42366-bug-15874.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42366
+# 0016-archival-disallow-path-traversals-CVE-2023-39810.patch
+BUSYBOX_IGNORE_CVES += CVE-2023-39810
+
# 0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
BUSYBOX_IGNORE_CVES += CVE-2024-58251
--
2.55.0
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot