From 48a13ef69e6f58479e5f3bbf42022fd5f25d004d Mon Sep 17 00:00:00 2001 From: chengyechun Date: Thu, 11 May 2023 17:22:33 +0800 Subject: [PATCH] fix CVE-2023-26551 --- backport-CVE-2023-26551.patch | 49 +++++++++++++++++++++++++++++++++++ ntp.spec | 9 ++++++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-26551.patch diff --git a/backport-CVE-2023-26551.patch b/backport-CVE-2023-26551.patch new file mode 100644 index 0000000..ea5bd5d --- /dev/null +++ b/backport-CVE-2023-26551.patch @@ -0,0 +1,49 @@ +From 562c0cc96b42afce4eeef8da8ac315f03e2e99df Mon Sep 17 00:00:00 2001 +From: Miroslva Lichvar +Date: Thu, 20 Apr 2023 08:27:41 PM GMT+0800 +Subject: [PATCH] mstolfp:make sure the buffer has enough room for the +input extra characters + +Reference:https://build.opensuse.org/package/view_file/openSUSE:Factory/ntp/ntp-CVE-2023-26551.patch?expand=1 +Conflict:NA + +CVE-2023-26552, CVE-2023-26553 and CVE-2023-26554 are marked identical +to CVE-2023-26551 +https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1507034339 + +--- + libntp/mstolfp.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/libntp/mstolfp.c b/libntp/mstolfp.c +index 3dfc4ef..a8defa2 100644 +--- a/libntp/mstolfp.c ++++ b/libntp/mstolfp.c +@@ -14,7 +14,7 @@ mstolfp( + l_fp *lfp + ) + { +- register const char *cp; ++ register const char *cp, *end; + register char *bp; + register const char *cpdec; + char buf[100]; +@@ -42,6 +42,15 @@ mstolfp( + if (*cp != '.' && !isdigit((unsigned char)*cp)) + return 0; + ++ /* ++ * Make sure the buffer has enough room for the input string and the ++ * extra characters, in the worst case replacing "." with "0.000" ++ */ ++ end = cp; ++ while (isdigit((unsigned char)*end) || *end == '.') ++ end++; ++ if (end - cp + 4 >= sizeof (buf) - (bp - buf)) ++ return 0; + + /* + * Search forward for the decimal point or the end of the string. +-- +2.27.0 + diff --git a/ntp.spec b/ntp.spec index d6a6020..ffcd31e 100644 --- a/ntp.spec +++ b/ntp.spec @@ -2,7 +2,7 @@ Name: ntp Version: 4.2.8p15 -Release: 7 +Release: 8 Summary: A protocol designed to synchronize the clocks of computers over a network License: MIT and BSD and BSD with advertising URL: https://www.ntp.org/ @@ -26,6 +26,7 @@ Patch3: bugfix-fix-ifindex-length.patch Patch4: fix-multiple-defination-with-gcc-10.patch Patch5: Do-not-use-PTHREAD_STACK_MIN-on-glibc.patch Patch6: fix-MD5-manpage.patch +Patch7: backport-CVE-2023-26551.patch BuildRequires: libcap-devel openssl-devel libedit-devel libevent-devel pps-tools-devel BuildRequires: autogen autogen-libopts-devel systemd gcc perl-generators perl-HTML-Parser libtool @@ -211,6 +212,12 @@ make check %{_mandir}/man8/*.8* %changelog +* Thu May 11 2023 chengyechun - 4.2.8p15-8 +- Type:CVE +- ID:CVE-2023-26551 +- SUG:NA +- DESC:make sure the buffer has enough room for the input extra characters + * Thu Nov 24 2022 chengyechun - 4.2.8p15-7 - Type:bugfix - ID:NA -- Gitee