From 4e07cc4bc0b591a3d3d61cd32d1aaaccc70beed5 Mon Sep 17 00:00:00 2001 From: Rmys Date: Tue, 23 Mar 2021 18:15:16 +0300 Subject: [PATCH] busybox rebuild CVE-2021-28831.patch --- .../files/busybox-1.33.0-CVE-2021-28831.patch | 33 ++++++++++++++++++ system/base/busybox/files/config | 34 +++++++++---------- system/base/busybox/pspec.xml | 9 ++++- 3 files changed, 58 insertions(+), 18 deletions(-) create mode 100644 system/base/busybox/files/busybox-1.33.0-CVE-2021-28831.patch diff --git a/system/base/busybox/files/busybox-1.33.0-CVE-2021-28831.patch b/system/base/busybox/files/busybox-1.33.0-CVE-2021-28831.patch new file mode 100644 index 00000000..aee03197 --- /dev/null +++ b/system/base/busybox/files/busybox-1.33.0-CVE-2021-28831.patch @@ -0,0 +1,33 @@ +diff -up busybox-1.33.0/archival/libarchive/decompress_gunzip.c.CVE-2021-28831 busybox-1.33.0/archival/libarchive/decompress_gunzip.c +--- busybox-1.33.0/archival/libarchive/decompress_gunzip.c.CVE-2021-28831 2021-03-22 13:55:11.883398937 -0400 ++++ busybox-1.33.0/archival/libarchive/decompress_gunzip.c 2021-03-22 13:56:09.316681291 -0400 +@@ -220,10 +220,20 @@ static const uint8_t border[] ALIGN1 = { + * each table. + * t: table to free + */ ++#define BAD_HUFT(p) ((uintptr_t)(p) & 1) ++#define ERR_RET ((huft_t*)(uintptr_t)1) + static void huft_free(huft_t *p) + { + huft_t *q; + ++ /* ++ * If 'p' has the error bit set we have to clear it, otherwise we might run ++ * into a segmentation fault or an invalid pointer to free(p) ++ */ ++ if (BAD_HUFT(p)) { ++ p = (huft_t*)((uintptr_t)(p) ^ (uintptr_t)(ERR_RET)); ++ } ++ + /* Go through linked list, freeing from the malloced (t[-1]) address. */ + while (p) { + q = (--p)->v.t; +@@ -289,8 +299,6 @@ static unsigned fill_bitbuffer(STATE_PAR + * or a valid pointer to a Huffman table, ORed with 0x1 if incompete table + * is given: "fixed inflate" decoder feeds us such data. + */ +-#define BAD_HUFT(p) ((uintptr_t)(p) & 1) +-#define ERR_RET ((huft_t*)(uintptr_t)1) + static huft_t* huft_build(const unsigned *b, const unsigned n, + const unsigned s, const struct cp_ext *cp_ext, + unsigned *m) diff --git a/system/base/busybox/files/config b/system/base/busybox/files/config index 0e4e41ed..75083e28 100644 --- a/system/base/busybox/files/config +++ b/system/base/busybox/files/config @@ -1,7 +1,7 @@ # # Automatically generated make config: don't edit # Busybox version: 1.33.0 -# Fri Feb 19 12:30:54 2021 +# Sun Mar 21 15:29:45 2021 # CONFIG_HAVE_DOT_CONFIG=y @@ -485,9 +485,9 @@ CONFIG_FEATURE_XARGS_SUPPORT_ARGS_FILE=y # # Init Utilities # -CONFIG_BOOTCHARTD=y -CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER=y -CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE=y +# CONFIG_BOOTCHARTD is not set +# CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER is not set +# CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE is not set CONFIG_HALT=y CONFIG_POWEROFF=y CONFIG_REBOOT=y @@ -496,15 +496,15 @@ CONFIG_REBOOT=y CONFIG_TELINIT_PATH="" CONFIG_INIT=y CONFIG_LINUXRC=y -CONFIG_FEATURE_USE_INITTAB=y +# CONFIG_FEATURE_USE_INITTAB is not set # CONFIG_FEATURE_KILL_REMOVED is not set CONFIG_FEATURE_KILL_DELAY=0 -CONFIG_FEATURE_INIT_SCTTY=y +# CONFIG_FEATURE_INIT_SCTTY is not set # CONFIG_FEATURE_INIT_SYSLOG is not set -CONFIG_FEATURE_INIT_QUIET=y -CONFIG_FEATURE_INIT_COREDUMPS=y -CONFIG_INIT_TERMINAL_TYPE="linux" -CONFIG_FEATURE_INIT_MODIFY_CMDLINE=y +# CONFIG_FEATURE_INIT_QUIET is not set +# CONFIG_FEATURE_INIT_COREDUMPS is not set +CONFIG_INIT_TERMINAL_TYPE="" +# CONFIG_FEATURE_INIT_MODIFY_CMDLINE is not set # # Login/Password Management Utilities @@ -587,8 +587,8 @@ CONFIG_DEFAULT_DEPMOD_FILE="modules.dep" # # Linux System Utilities # -# CONFIG_ACPID is not set -# CONFIG_FEATURE_ACPID_COMPAT is not set +CONFIG_ACPID=y +CONFIG_FEATURE_ACPID_COMPAT=y CONFIG_BLKDISCARD=y CONFIG_BLKID=y CONFIG_FEATURE_BLKID_TYPE=y @@ -651,7 +651,7 @@ CONFIG_MKFS_MINIX=y CONFIG_FEATURE_MINIX2=y # CONFIG_MKFS_REISER is not set CONFIG_MKDOSFS=y -# CONFIG_MKFS_VFAT is not set +CONFIG_MKFS_VFAT=y CONFIG_MKSWAP=y CONFIG_FEATURE_MKSWAP_UUID=y CONFIG_MORE=y @@ -889,7 +889,7 @@ CONFIG_IFENSLAVE=y CONFIG_IFPLUGD=y CONFIG_IFUP=y CONFIG_IFDOWN=y -CONFIG_IFUPDOWN_IFSTATE_PATH="/var/run/ifstate" +CONFIG_IFUPDOWN_IFSTATE_PATH="" CONFIG_FEATURE_IFUPDOWN_IP=y CONFIG_FEATURE_IFUPDOWN_IPV4=y CONFIG_FEATURE_IFUPDOWN_IPV6=y @@ -985,7 +985,7 @@ CONFIG_ZCIP=y CONFIG_UDHCPD=y CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y -CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases" +CONFIG_DHCPD_LEASES_FILE="" CONFIG_DUMPLEASES=y CONFIG_DHCPRELAY=y CONFIG_UDHCPC=y @@ -1024,7 +1024,7 @@ CONFIG_FEATURE_POPMAILDIR_DELIVERY=y CONFIG_REFORMIME=y CONFIG_FEATURE_REFORMIME_COMPAT=y CONFIG_SENDMAIL=y -CONFIG_FEATURE_MIME_CHARSET="us-ascii" +CONFIG_FEATURE_MIME_CHARSET="" # # Process Utilities @@ -1081,7 +1081,7 @@ CONFIG_RUNSV=y CONFIG_RUNSVDIR=y # CONFIG_FEATURE_RUNSVDIR_LOG is not set CONFIG_SV=y -CONFIG_SV_DEFAULT_SERVICE_DIR="/var/service" +CONFIG_SV_DEFAULT_SERVICE_DIR="" CONFIG_SVC=y CONFIG_SVOK=y CONFIG_SVLOGD=y diff --git a/system/base/busybox/pspec.xml b/system/base/busybox/pspec.xml index ca2907cc..af735fce 100644 --- a/system/base/busybox/pspec.xml +++ b/system/base/busybox/pspec.xml @@ -20,7 +20,7 @@ udhcp-rootpath-rq.patch suppress-job-control-warning.patch - + busybox-1.33.0-CVE-2021-28831.patch @@ -33,6 +33,13 @@ + + 2021-03-23 + 1.33.0 + Rebuild. + Mustafa Cinasal + muscnsl@gmail.com + 2020-12-31 1.33.0