From eebd594208175b2a44ae5b5be21901b227493acf Mon Sep 17 00:00:00 2001 From: SuperSix173 Date: Tue, 15 Aug 2023 14:54:57 +0800 Subject: [PATCH] ps: Fix possible buffer overflow in -C option Signed-off-by: SuperSix173 --- ...possible-buffer-overflow-in-C-option.patch | 70 +++++++++++++++++++ procps-ng.spec | 6 +- 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 0007-ps-Fix-possible-buffer-overflow-in-C-option.patch diff --git a/0007-ps-Fix-possible-buffer-overflow-in-C-option.patch b/0007-ps-Fix-possible-buffer-overflow-in-C-option.patch new file mode 100644 index 0000000..3b23437 --- /dev/null +++ b/0007-ps-Fix-possible-buffer-overflow-in-C-option.patch @@ -0,0 +1,70 @@ +From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 +From: Craig Small +Date: Thu, 10 Aug 2023 21:18:38 +1000 +Subject: [PATCH] ps: Fix possible buffer overflow in -C option + +ps allocates memory using malloc(length of arg * len of struct). +In certain strange circumstances, the arg length could be very large +and the multiplecation will overflow, allocating a small amount of +memory. + +Subsequent strncpy() will then write into unallocated memory. +The fix is to use calloc. It's slower but this is a one-time +allocation. Other malloc(x * y) calls have also been replaced +by calloc(x, y) + +References: + https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 + https://nvd.nist.gov/vuln/detail/CVE-2023-4016 + https://gitlab.com/procps-ng/procps/-/issues/297 + https://bugs.debian.org/1042887 + +Conflict: remove NEWS part + +Signed-off-by: Craig Small +--- + ps/parser.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/ps/parser.c b/ps/parser.c +index 248aa741..15873dfa 100644 +--- a/ps/parser.c ++++ b/ps/parser.c +@@ -189,7 +189,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s + const char *err; /* error code that could or did happen */ + /*** prepare to operate ***/ + node = malloc(sizeof(selection_node)); +- node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ + node->n = 0; + buf = strdup(arg); + /*** sanity check and count items ***/ +@@ -210,6 +209,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s + } while (*++walk); + if(need_item) goto parse_error; + node->n = items; ++ node->u = calloc(items, sizeof(sel_union)); + /*** actually parse the list ***/ + walk = buf; + while(items--){ +@@ -1050,15 +1050,15 @@ static const char *parse_trailing_pids(void){ + thisarg = ps_argc - 1; /* we must be at the end now */ + + pidnode = malloc(sizeof(selection_node)); +- pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ pidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ + pidnode->n = 0; + + grpnode = malloc(sizeof(selection_node)); +- grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ grpnode->u = calloc(i,sizeof(sel_union)); /* waste is insignificant */ + grpnode->n = 0; + + sidnode = malloc(sizeof(selection_node)); +- sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ sidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ + sidnode->n = 0; + + while(i--){ +-- +2.33.0 + diff --git a/procps-ng.spec b/procps-ng.spec index 2ccc66d..f66a5fc 100644 --- a/procps-ng.spec +++ b/procps-ng.spec @@ -1,6 +1,6 @@ Name: procps-ng Version: 3.3.17 -Release: 4 +Release: 5 Summary: Utilities that provide system information. License: GPL+ and GPLv2 and GPLv2+ and GPLv3+ and LGPLv2+ URL: https://sourceforge.net/projects/procps-ng/ @@ -15,6 +15,7 @@ Patch3: 0003-add-options-M-and-N-for-top.patch Patch4: 0004-top-exit-with-error-when-pid-overflow.patch Patch5: 0005-fix-a-fix-for-the-bye_bye-function.patch Patch6: 0006-top-eliminate-a-potential-abend-when-exiting-A-mode.patch +Patch7: 0007-ps-Fix-possible-buffer-overflow-in-C-option.patch BuildRequires: ncurses-devel libtool autoconf automake gcc gettext-devel systemd-devel systemd-pam @@ -94,6 +95,9 @@ ln -s %{_bindir}/pidof %{buildroot}%{_sbindir}/pidof %{_mandir}/man* %changelog +* Tue Aug 15 2023 Liu Chao - 3.3.17-5 +- ps: Fix possible buffer overflow in -C option + * Mon Nov 7 2022 zhoujie - 3.3.17-4 - top eliminate a potential abend when exiting A mode -- Gitee