From 05b96387d955c2070f9ce5cfd7df1dd63328e993 Mon Sep 17 00:00:00 2001 From: zhuofeng Date: Wed, 9 Nov 2022 18:44:19 +0800 Subject: [PATCH] fix cve-2022-42919 --- backport-CVE-2022-42919.patch | 68 +++++++++++++++++++++++++++++++++++ python3.spec | 10 +++++- 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-42919.patch diff --git a/backport-CVE-2022-42919.patch b/backport-CVE-2022-42919.patch new file mode 100644 index 0000000..81bec70 --- /dev/null +++ b/backport-CVE-2022-42919.patch @@ -0,0 +1,68 @@ +From b43496c01a554cf41ae654a0379efae18609ad39 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Fri, 28 Oct 2022 03:08:30 -0700 +Subject: [PATCH] [3.9] gh-97514: Don't use Linux abstract sockets for + multiprocessing (GH-98501) (#98504) + +Linux abstract sockets are insecure as they lack any form of filesystem +permissions so their use allows anyone on the system to inject code into +the process. + +This removes the default preference for abstract sockets in +multiprocessing introduced in Python 3.9+ via +https://github.com/python/cpython/pull/18866 while fixing +https://github.com/python/cpython/issues/84031. + +Explicit use of an abstract socket by a user now generates a +RuntimeWarning. If we choose to keep this warning, it should be +backported to the 3.7 and 3.8 branches. +(cherry picked from commit 49f61068f49747164988ffc5a442d2a63874fc17) + +Co-authored-by: Gregory P. Smith +--- + Lib/multiprocessing/connection.py | 5 ----- + .../2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst | 15 +++++++++++++++ + 2 files changed, 15 insertions(+), 5 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst + +diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py +index 510e4b5aba..8e2facf92a 100644 +--- a/Lib/multiprocessing/connection.py ++++ b/Lib/multiprocessing/connection.py +@@ -73,11 +73,6 @@ def arbitrary_address(family): + if family == 'AF_INET': + return ('localhost', 0) + elif family == 'AF_UNIX': +- # Prefer abstract sockets if possible to avoid problems with the address +- # size. When coding portable applications, some implementations have +- # sun_path as short as 92 bytes in the sockaddr_un struct. +- if util.abstract_sockets_supported: +- return f"\0listener-{os.getpid()}-{next(_mmap_counter)}" + return tempfile.mktemp(prefix='listener-', dir=util.get_temp_dir()) + elif family == 'AF_PIPE': + return tempfile.mktemp(prefix=r'\\.\pipe\pyc-%d-%d-' % +diff --git a/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst +new file mode 100644 +index 0000000000..02d95b5705 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst +@@ -0,0 +1,15 @@ ++On Linux the :mod:`multiprocessing` module returns to using filesystem backed ++unix domain sockets for communication with the *forkserver* process instead of ++the Linux abstract socket namespace. Only code that chooses to use the ++:ref:`"forkserver" start method ` is affected. ++ ++Abstract sockets have no permissions and could allow any user on the system in ++the same `network namespace ++`_ (often the ++whole system) to inject code into the multiprocessing *forkserver* process. ++This was a potential privilege escalation. Filesystem based socket permissions ++restrict this to the *forkserver* process user as was the default in Python 3.8 ++and earlier. ++ ++This prevents Linux `CVE-2022-42919 ++`_. +-- +2.27.0 + diff --git a/python3.spec b/python3.spec index 3e7fccd..4e0717b 100644 --- a/python3.spec +++ b/python3.spec @@ -3,7 +3,7 @@ Summary: Interpreter of the Python3 programming language URL: https://www.python.org/ Version: 3.9.9 -Release: 15 +Release: 16 License: Python-2.0 %global branchversion 3.9 @@ -98,6 +98,7 @@ Patch6006: backport-bpo-35823-subprocess-Use-vfork-instead-of-fork-on-Li.patch Patch6007: backport-bpo-35823-subprocess-Fix-handling-of-pthread_sigmask.patch Patch6008: backport-bpo-35823-Allow-setsid-after-vfork-on-Linux.-GH-2294.patch Patch6009: backport-bpo-42146-Unify-cleanup-in-subprocess_fork_exec-GH-2.patch +Patch6010: backport-CVE-2022-42919.patch Patch9000: add-the-sm3-method-for-obtaining-the-salt-value.patch @@ -193,6 +194,7 @@ rm -r Modules/expat %patch6007 -p1 %patch6008 -p1 %patch6009 -p1 +%patch6010 -p1 %patch9000 -p1 @@ -809,6 +811,12 @@ export BEP_GTDLIST="$BEP_GTDLIST_TMP" %{_mandir}/*/* %changelog +* Wed Nov 09 zhuofeng - 3.9.9-16 +- Type:CVE +- CVE:CVE-2022-42919 +- SUG:NA +- DESC:fix CVE-2022-42919 + * Thu Sep 22 zhuofeng - 3.9.9-15 - Type:bugfix - CVE:NA -- Gitee