From fceaf1c14692d6e834a884a3fa821dd6ae53c0f6 Mon Sep 17 00:00:00 2001 From: dillon_chen Date: Mon, 18 Sep 2023 17:22:24 +0800 Subject: [PATCH] CVE-2023-2977 (cherry picked from commit 3611e52982ea35f1552bf36f0e960cbbd621be57) --- ...eft_length_calculation_to_fix_buffer.patch | 49 +++++++++++++++++++ opensc.spec | 6 ++- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 backport-0006-CVE-2023-2977-correct_left_length_calculation_to_fix_buffer.patch diff --git a/backport-0006-CVE-2023-2977-correct_left_length_calculation_to_fix_buffer.patch b/backport-0006-CVE-2023-2977-correct_left_length_calculation_to_fix_buffer.patch new file mode 100644 index 0000000..3226107 --- /dev/null +++ b/backport-0006-CVE-2023-2977-correct_left_length_calculation_to_fix_buffer.patch @@ -0,0 +1,49 @@ +From 3bf3ab2f9091f984cda6dd910654ccbbe3f06a40 Mon Sep 17 00:00:00 2001 +From: fullwaywang +Date: Mon, 29 May 2023 10:38:48 +0800 +Subject: [PATCH] pkcs15init: correct left length calculation to fix buffer + overrun bug. Fixes #2785 + +--- + src/pkcs15init/pkcs15-cardos.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/pkcs15init/pkcs15-cardos.c b/src/pkcs15init/pkcs15-cardos.c +index 9715cf390f..f41f73c349 100644 +--- a/src/pkcs15init/pkcs15-cardos.c ++++ b/src/pkcs15init/pkcs15-cardos.c +@@ -872,7 +872,7 @@ static int cardos_have_verifyrc_package(sc_card_t *card) + sc_apdu_t apdu; + u8 rbuf[SC_MAX_APDU_BUFFER_SIZE]; + int r; +- const u8 *p = rbuf, *q; ++ const u8 *p = rbuf, *q, *pp; + size_t len, tlen = 0, ilen = 0; + + sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, 0xca, 0x01, 0x88); +@@ -888,13 +888,13 @@ static int cardos_have_verifyrc_package(sc_card_t *card) + return 0; + + while (len != 0) { +- p = sc_asn1_find_tag(card->ctx, p, len, 0xe1, &tlen); +- if (p == NULL) ++ pp = sc_asn1_find_tag(card->ctx, p, len, 0xe1, &tlen); ++ if (pp == NULL) + return 0; + if (card->type == SC_CARD_TYPE_CARDOS_M4_3) { + /* the verifyRC package on CardOS 4.3B use Manufacturer ID 0x01 */ + /* and Package Number 0x07 */ +- q = sc_asn1_find_tag(card->ctx, p, tlen, 0x01, &ilen); ++ q = sc_asn1_find_tag(card->ctx, pp, tlen, 0x01, &ilen); + if (q == NULL || ilen != 4) + return 0; + if (q[0] == 0x07) +@@ -902,7 +902,7 @@ static int cardos_have_verifyrc_package(sc_card_t *card) + } else if (card->type == SC_CARD_TYPE_CARDOS_M4_4) { + /* the verifyRC package on CardOS 4.4 use Manufacturer ID 0x03 */ + /* and Package Number 0x02 */ +- q = sc_asn1_find_tag(card->ctx, p, tlen, 0x03, &ilen); ++ q = sc_asn1_find_tag(card->ctx, pp, tlen, 0x03, &ilen); + if (q == NULL || ilen != 4) + return 0; + if (q[0] == 0x02) diff --git a/opensc.spec b/opensc.spec index b0d5e48..158836e 100644 --- a/opensc.spec +++ b/opensc.spec @@ -3,7 +3,7 @@ Name: opensc Version: 0.21.0 -Release: 6 +Release: 7 License: LGPLv2.1+ Summary: Smart card library and applications URL: https://github.com/OpenSC/OpenSC/wiki @@ -37,6 +37,7 @@ Patch16: backport-0002-CVE-2021-42782-coolkey-Initialize-potentially.patch Patch17: backport-0003-CVE-2021-42782-cardos-Correctly-calculate-the-left.patch Patch18: backport-0004-CVE-2021-42782-iasecc-Prevent-stack-buffer.patch Patch19: backport-0005-CVE-2021-42782-PIV-Improved-parsing.patch +Patch20: backport-0006-CVE-2023-2977-correct_left_length_calculation_to_fix_buffer.patch %description OpenSC provides a set of libraries and utilities to work with smart cards. @@ -155,6 +156,9 @@ make check %{_datadir}/opensc/ %changelog +* Mon Sep 18 2023 dillon chen - 0.21.0-7 +- fix CVE-2023-2977 + * Mon May 9 2022 Hugel - 0.21.0-6 - fix CVE-2021-42782 -- Gitee