From 2d07634cfa14a5962f83e15e91411ab1f5d81b40 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Mon, 23 Oct 2023 16:49:52 +0100 Subject: [PATCH 1/8] New upstream stable version 1.18.1 --- libnbd.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index 62aa83f..8741453 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -8,7 +8,7 @@ %global source_directory 1.18-stable Name: libnbd -Version: 1.18.0 +Version: 1.18.1 Release: 1%{?dist} Summary: NBD client library in userspace @@ -375,8 +375,11 @@ make %{?_smp_mflags} check || { %changelog +* Mon Oct 23 2023 Richard W.M. Jones - 1.18.1-1 +- New upstream stable version 1.18.1 + * Wed Sep 27 2023 Richard W.M. Jones - 1.18.0-1 -- New upstream development version 1.18.0 +- New upstream stable version 1.18.0 * Fri Sep 08 2023 Richard W.M. Jones - 1.17.5-1 - New upstream development version 1.17.5 diff --git a/sources b/sources index 342dd92..8d0bf20 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.18.0.tar.gz) = e0dc41ce8cae8d6c8efd55ad560b847dd829ad355cd67e4f682ac2ad145f3ced8ea42650ce1b2cd562a1f6f8cf05680ff2e1a5bdf5b4e5f8237b1fb8ec132a3a -SHA512 (libnbd-1.18.0.tar.gz.sig) = a506add984fddb12bb073947cf5ef6f798c6db6aae521aced778b03d7feb0227a4cf5bc346d68ada3e3da47b533cdcfd9c4470fddf61bfa82ed148d862b5ec82 +SHA512 (libnbd-1.18.1.tar.gz) = f4262666be55d580550e053355f14f80d352bf869ae7241e9fa032a9b5cd9e027eb89a536871c1206422413fc7ed745da7d612b3e1413f76ec17168705fbf12c +SHA512 (libnbd-1.18.1.tar.gz.sig) = 57798aa8b8c0973c0e13f431a6735e13a5aa546190e5de9cb43f78d54c5438df70bdf6e875282a3c4221c222a1517c64bb311e769f7c1a3e61d5b1a4e7f75e2d From 905c23a73d01393fda96c519cd08c064fd447cb0 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 31 Oct 2023 14:22:21 +0000 Subject: [PATCH 2/8] Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871) (cherry picked from commit 267af1b60859fa32af67c11dd92b439fdd5d1973) --- ...sertion-in-ext-mode-BLOCK_STATUS-CVE.patch | 86 +++++++++++++++++++ libnbd.spec | 8 +- 2 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch diff --git a/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch b/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch new file mode 100644 index 0000000..e52dcd8 --- /dev/null +++ b/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch @@ -0,0 +1,86 @@ +From 177308adb17e81fce7c0f2b2fcf655c5c0b6a4d6 Mon Sep 17 00:00:00 2001 +From: Eric Blake +Date: Mon, 30 Oct 2023 12:50:53 -0500 +Subject: [PATCH] generator: Fix assertion in ext-mode BLOCK_STATUS, + CVE-2023-5871 + +Another round of fuzz testing revealed that when a server negotiates +extended headers and replies with a 64-bit flag value where the client +used the 32-bit API command, we were correctly flagging the server's +response as being an EOVERFLOW condition, but then immediately failing +in an assertion failure instead of reporting it to the application. + +The following one-byte change to qemu.git at commit fd9a38fd43 allows +the creation of an intentionally malicious server: + +| diff --git i/nbd/server.c w/nbd/server.c +| index 859c163d19f..32e1e771a95 100644 +| --- i/nbd/server.c +| +++ w/nbd/server.c +| @@ -2178,7 +2178,7 @@ static void nbd_extent_array_convert_to_be(NBDExtentArray *ea) +| +| for (i = 0; i < ea->count; i++) { +| ea->extents[i].length = cpu_to_be64(ea->extents[i].length); +| - ea->extents[i].flags = cpu_to_be64(ea->extents[i].flags); +| + ea->extents[i].flags = ~cpu_to_be64(ea->extents[i].flags); +| } +| } + +and can then be detected with the following command line: + +$ nbdsh -c - <<\EOF +> def f(a,b,c,d): +> pass +> +> h.connect_systemd_socket_activation(["/path/to/bad/qemu-nbd", +> "-r", "-f", "raw", "TODO"]) +> h.block_staus(h.get_size(), 0, f) +> EOF +nbdsh: generator/states-reply-chunk.c:626: enter_STATE_REPLY_CHUNK_REPLY_RECV_BS_ENTRIES: Assertion `(len | flags) <= UINT32_MAX' failed. +Aborted (core dumped) + +whereas a fixed libnbd will give: + +nbdsh: command line script failed: nbd_block_status: block-status: command failed: Value too large for defined data type + +We can either relax the assertion (by changing to 'assert ((len | +flags) <= UINT32_MAX || cmd->error)'), or intentionally truncate flags +to make the existing assertion reliable. This patch goes with the +latter approach. + +Sadly, this crash is possible in all existing 1.18.x stable releases, +if they were built with assertions enabled (most distros do this by +default), meaning a malicious server has an easy way to cause a Denial +of Service attack by triggering the assertion failure in vulnerable +clients, so we have assigned this CVE-2023-5871. Mitigating factors: +the crash only happens for a server that sends a 64-bit status block +reply (no known production servers do so; qemu 8.2 will be the first +known server to support extended headers, but it is not yet released); +and as usual, a client can use TLS to guarantee it is connecting only +to a known-safe server. If libnbd is compiled without assertions, +there is no crash or other mistaken behavior; and when assertions are +enabled, the attacker cannot accomplish anything more than a denial of +service. + +Reported-by: Richard W.M. Jones +Fixes: 20dadb0e10 ("generator: Prepare for extent64 callback", v1.17.4) +Signed-off-by: Eric Blake +--- + generator/states-reply-chunk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/generator/states-reply-chunk.c b/generator/states-reply-chunk.c +index 5a31c19..8ab7e8b 100644 +--- a/generator/states-reply-chunk.c ++++ b/generator/states-reply-chunk.c +@@ -600,6 +600,7 @@ STATE_MACHINE { + break; /* Skip this and later extents; we already made progress */ + /* Expose this extent as an error; we made no progress */ + cmd->error = cmd->error ? : EOVERFLOW; ++ flags = (uint32_t)flags; + } + } + +-- +2.41.0 + diff --git a/libnbd.spec b/libnbd.spec index 8741453..a2cad47 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -9,7 +9,7 @@ Name: libnbd Version: 1.18.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: NBD client library in userspace License: LGPL-2.0-or-later AND BSD-3-Clause @@ -25,6 +25,9 @@ Source2: libguestfs.keyring # Maintainer script which helps with handling patches. Source3: copy-patches.sh +# CVE-2023-5871 +Patch: 0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch + %if 0%{patches_touch_autotools} BuildRequires: autoconf, automake, libtool %endif @@ -375,6 +378,9 @@ make %{?_smp_mflags} check || { %changelog +* Tue Oct 31 2023 Richard W.M. Jones - 1.18.1-2 +- Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871) + * Mon Oct 23 2023 Richard W.M. Jones - 1.18.1-1 - New upstream stable version 1.18.1 From edf84fa120bd77b3aa8289b3e232991e8ee56a41 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 16 Jan 2024 14:15:14 +0000 Subject: [PATCH 3/8] New upstream stable version 1.18.2 --- libnbd.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index a2cad47..21d5fb2 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -8,8 +8,8 @@ %global source_directory 1.18-stable Name: libnbd -Version: 1.18.1 -Release: 2%{?dist} +Version: 1.18.2 +Release: 1%{?dist} Summary: NBD client library in userspace License: LGPL-2.0-or-later AND BSD-3-Clause @@ -378,6 +378,9 @@ make %{?_smp_mflags} check || { %changelog +* Tue Jan 16 2024 Richard W.M. Jones - 1.18.2-1 +- New upstream stable version 1.18.2 + * Tue Oct 31 2023 Richard W.M. Jones - 1.18.1-2 - Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871) diff --git a/sources b/sources index 8d0bf20..823c1b0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.18.1.tar.gz) = f4262666be55d580550e053355f14f80d352bf869ae7241e9fa032a9b5cd9e027eb89a536871c1206422413fc7ed745da7d612b3e1413f76ec17168705fbf12c -SHA512 (libnbd-1.18.1.tar.gz.sig) = 57798aa8b8c0973c0e13f431a6735e13a5aa546190e5de9cb43f78d54c5438df70bdf6e875282a3c4221c222a1517c64bb311e769f7c1a3e61d5b1a4e7f75e2d +SHA512 (libnbd-1.18.2.tar.gz) = e27adc5a8b5e7e75fbc45a1c19c4f897cefa97d8aea82e447826b967170d4e14683b9d0d058a8441b8b46253c83f4b1a7e9fe3eb2eef3aaddaaaee6262d53d6e +SHA512 (libnbd-1.18.2.tar.gz.sig) = 2a5b7ef2cd53f03fbf5d20b3b4f615595298e595d40c653de7f7e2e0a6bc0cdb3a88b1264277d8fc125cf5282587de36d23a661e2ec9fb62a0cb778ce1991236 From be0531484031fc9818c87d3acb0ff8f2054b618c Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 16 Jan 2024 14:25:04 +0000 Subject: [PATCH 4/8] Remove patch already upstream --- ...sertion-in-ext-mode-BLOCK_STATUS-CVE.patch | 86 ------------------- libnbd.spec | 3 - 2 files changed, 89 deletions(-) delete mode 100644 0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch diff --git a/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch b/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch deleted file mode 100644 index e52dcd8..0000000 --- a/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 177308adb17e81fce7c0f2b2fcf655c5c0b6a4d6 Mon Sep 17 00:00:00 2001 -From: Eric Blake -Date: Mon, 30 Oct 2023 12:50:53 -0500 -Subject: [PATCH] generator: Fix assertion in ext-mode BLOCK_STATUS, - CVE-2023-5871 - -Another round of fuzz testing revealed that when a server negotiates -extended headers and replies with a 64-bit flag value where the client -used the 32-bit API command, we were correctly flagging the server's -response as being an EOVERFLOW condition, but then immediately failing -in an assertion failure instead of reporting it to the application. - -The following one-byte change to qemu.git at commit fd9a38fd43 allows -the creation of an intentionally malicious server: - -| diff --git i/nbd/server.c w/nbd/server.c -| index 859c163d19f..32e1e771a95 100644 -| --- i/nbd/server.c -| +++ w/nbd/server.c -| @@ -2178,7 +2178,7 @@ static void nbd_extent_array_convert_to_be(NBDExtentArray *ea) -| -| for (i = 0; i < ea->count; i++) { -| ea->extents[i].length = cpu_to_be64(ea->extents[i].length); -| - ea->extents[i].flags = cpu_to_be64(ea->extents[i].flags); -| + ea->extents[i].flags = ~cpu_to_be64(ea->extents[i].flags); -| } -| } - -and can then be detected with the following command line: - -$ nbdsh -c - <<\EOF -> def f(a,b,c,d): -> pass -> -> h.connect_systemd_socket_activation(["/path/to/bad/qemu-nbd", -> "-r", "-f", "raw", "TODO"]) -> h.block_staus(h.get_size(), 0, f) -> EOF -nbdsh: generator/states-reply-chunk.c:626: enter_STATE_REPLY_CHUNK_REPLY_RECV_BS_ENTRIES: Assertion `(len | flags) <= UINT32_MAX' failed. -Aborted (core dumped) - -whereas a fixed libnbd will give: - -nbdsh: command line script failed: nbd_block_status: block-status: command failed: Value too large for defined data type - -We can either relax the assertion (by changing to 'assert ((len | -flags) <= UINT32_MAX || cmd->error)'), or intentionally truncate flags -to make the existing assertion reliable. This patch goes with the -latter approach. - -Sadly, this crash is possible in all existing 1.18.x stable releases, -if they were built with assertions enabled (most distros do this by -default), meaning a malicious server has an easy way to cause a Denial -of Service attack by triggering the assertion failure in vulnerable -clients, so we have assigned this CVE-2023-5871. Mitigating factors: -the crash only happens for a server that sends a 64-bit status block -reply (no known production servers do so; qemu 8.2 will be the first -known server to support extended headers, but it is not yet released); -and as usual, a client can use TLS to guarantee it is connecting only -to a known-safe server. If libnbd is compiled without assertions, -there is no crash or other mistaken behavior; and when assertions are -enabled, the attacker cannot accomplish anything more than a denial of -service. - -Reported-by: Richard W.M. Jones -Fixes: 20dadb0e10 ("generator: Prepare for extent64 callback", v1.17.4) -Signed-off-by: Eric Blake ---- - generator/states-reply-chunk.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/generator/states-reply-chunk.c b/generator/states-reply-chunk.c -index 5a31c19..8ab7e8b 100644 ---- a/generator/states-reply-chunk.c -+++ b/generator/states-reply-chunk.c -@@ -600,6 +600,7 @@ STATE_MACHINE { - break; /* Skip this and later extents; we already made progress */ - /* Expose this extent as an error; we made no progress */ - cmd->error = cmd->error ? : EOVERFLOW; -+ flags = (uint32_t)flags; - } - } - --- -2.41.0 - diff --git a/libnbd.spec b/libnbd.spec index 21d5fb2..476f788 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -25,9 +25,6 @@ Source2: libguestfs.keyring # Maintainer script which helps with handling patches. Source3: copy-patches.sh -# CVE-2023-5871 -Patch: 0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch - %if 0%{patches_touch_autotools} BuildRequires: autoconf, automake, libtool %endif From d5988b1281856957bcd8b8e7f622df3ca5001a5f Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Mon, 4 Mar 2024 18:35:11 +0000 Subject: [PATCH 5/8] New upstream stable version 1.18.3 --- libnbd.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index 476f788..2b7156f 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -8,7 +8,7 @@ %global source_directory 1.18-stable Name: libnbd -Version: 1.18.2 +Version: 1.18.3 Release: 1%{?dist} Summary: NBD client library in userspace @@ -375,6 +375,9 @@ make %{?_smp_mflags} check || { %changelog +* Mon Mar 04 2024 Richard W.M. Jones - 1.18.3-1 +- New upstream stable version 1.18.3 + * Tue Jan 16 2024 Richard W.M. Jones - 1.18.2-1 - New upstream stable version 1.18.2 diff --git a/sources b/sources index 823c1b0..086670e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.18.2.tar.gz) = e27adc5a8b5e7e75fbc45a1c19c4f897cefa97d8aea82e447826b967170d4e14683b9d0d058a8441b8b46253c83f4b1a7e9fe3eb2eef3aaddaaaee6262d53d6e -SHA512 (libnbd-1.18.2.tar.gz.sig) = 2a5b7ef2cd53f03fbf5d20b3b4f615595298e595d40c653de7f7e2e0a6bc0cdb3a88b1264277d8fc125cf5282587de36d23a661e2ec9fb62a0cb778ce1991236 +SHA512 (libnbd-1.18.3.tar.gz) = e6dab106280659f017c8135e3297b9841be4b6accb162c5b06e2ec33d5e5211a55077fcdb322aece3e863fa57cfb38eb303cb15a6d2f99babdd9d716b57e2af0 +SHA512 (libnbd-1.18.3.tar.gz.sig) = 46908b0da1884283eade7ebb63cd5ec1e6c9114a305e3ae9f050c3aeb3a801dd2b3ec96f5bf887a29e65d076b6c3a4621b9365f5d530d21c4327a7f1667818a2 From 738cc59ca85ebbf00cbc2b6df227330371903dbf Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Thu, 4 Apr 2024 21:23:56 +0100 Subject: [PATCH 6/8] Rebuild autoconf cruft unconditionally (cherry picked from commit 11a78d929de957995cf127e70c2762326132a263) --- libnbd.spec | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index 2b7156f..e3c6fff 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -1,9 +1,6 @@ # If we should verify tarball signature with GPGv2. %global verify_tarball_signature 1 -# If there are patches which touch autotools files, set this to 1. -%global patches_touch_autotools %{nil} - # The source directory. %global source_directory 1.18-stable @@ -25,14 +22,13 @@ Source2: libguestfs.keyring # Maintainer script which helps with handling patches. Source3: copy-patches.sh -%if 0%{patches_touch_autotools} -BuildRequires: autoconf, automake, libtool -%endif - %if 0%{verify_tarball_signature} BuildRequires: gnupg2 %endif +# For rebuilding autoconf cruft. +BuildRequires: autoconf, automake, libtool + # For the core library. BuildRequires: gcc BuildRequires: make @@ -207,9 +203,7 @@ for %{name}. %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %endif %autosetup -p1 -%if 0%{patches_touch_autotools} autoreconf -i -%endif %build From f48d94c31f49769770a9253403334d67b1b6c785 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Thu, 4 Apr 2024 21:32:49 +0100 Subject: [PATCH 7/8] New upstream stable version 1.18.4 --- libnbd.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index e3c6fff..d09f6cc 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -5,7 +5,7 @@ %global source_directory 1.18-stable Name: libnbd -Version: 1.18.3 +Version: 1.18.4 Release: 1%{?dist} Summary: NBD client library in userspace @@ -369,6 +369,9 @@ make %{?_smp_mflags} check || { %changelog +* Thu Apr 04 2024 Richard W.M. Jones - 1.18.4-1 +- New upstream stable version 1.18.4 + * Mon Mar 04 2024 Richard W.M. Jones - 1.18.3-1 - New upstream stable version 1.18.3 diff --git a/sources b/sources index 086670e..51eede8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.18.3.tar.gz) = e6dab106280659f017c8135e3297b9841be4b6accb162c5b06e2ec33d5e5211a55077fcdb322aece3e863fa57cfb38eb303cb15a6d2f99babdd9d716b57e2af0 -SHA512 (libnbd-1.18.3.tar.gz.sig) = 46908b0da1884283eade7ebb63cd5ec1e6c9114a305e3ae9f050c3aeb3a801dd2b3ec96f5bf887a29e65d076b6c3a4621b9365f5d530d21c4327a7f1667818a2 +SHA512 (libnbd-1.18.4.tar.gz) = 638d922b340b022b504e0f39d3a52ce6a93f5a2476d33bf8ccc629f15d4937854117bcb48cbbe25664c2a957c1c00effbf24c6339ad06d031f684ac76bbfd2b1 +SHA512 (libnbd-1.18.4.tar.gz.sig) = 3ad7359ceb558604adbeee256de8b3ea78849f8937029e1ba281bd46e7d2b355e6710b557571235dc1b6e3b069f55c595c6c403685905bce7d1ad22bed868c03 From ca75394a58fba48c732a8bbe683af40734bbce72 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 25 Jun 2024 21:48:29 +0100 Subject: [PATCH 8/8] New upstream stable version 1.18.5 Fix: multiple flaws in TLS server certificate checking --- libnbd.spec | 6 +++++- sources | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index d09f6cc..59b152d 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -5,7 +5,7 @@ %global source_directory 1.18-stable Name: libnbd -Version: 1.18.4 +Version: 1.18.5 Release: 1%{?dist} Summary: NBD client library in userspace @@ -369,6 +369,10 @@ make %{?_smp_mflags} check || { %changelog +* Tue Jun 25 2024 Richard W.M. Jones - 1.18.5 +- New upstream stable version 1.18.5 +- Fix: multiple flaws in TLS server certificate checking + * Thu Apr 04 2024 Richard W.M. Jones - 1.18.4-1 - New upstream stable version 1.18.4 diff --git a/sources b/sources index 51eede8..ee43a93 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.18.4.tar.gz) = 638d922b340b022b504e0f39d3a52ce6a93f5a2476d33bf8ccc629f15d4937854117bcb48cbbe25664c2a957c1c00effbf24c6339ad06d031f684ac76bbfd2b1 -SHA512 (libnbd-1.18.4.tar.gz.sig) = 3ad7359ceb558604adbeee256de8b3ea78849f8937029e1ba281bd46e7d2b355e6710b557571235dc1b6e3b069f55c595c6c403685905bce7d1ad22bed868c03 +SHA512 (libnbd-1.18.5.tar.gz) = baf9955ce2a176f0f8f48fa6e1b27066c5a3d03adcd5ebd1a63bf4651ba23a135eeb0d39d41ded94ba653aa4b9bce5da9747afb208e71a542fcad7ac8c28b106 +SHA512 (libnbd-1.18.5.tar.gz.sig) = a0db3cc49f78967a3f724dcca56b84f23007d3afcf05853d8d9cac10fb34a8d591ee30650111ff5df7184fac6ba100d6a7782b36e1f210ea9564c76d4085cfd8