* [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1
@ 2022-03-30 13:25 Christian Melki
2022-03-30 17:48 ` Michael Olbrich
0 siblings, 1 reply; 5+ messages in thread
From: Christian Melki @ 2022-03-30 13:25 UTC (permalink / raw)
To: ptxdist
Security miss, integer overflow in the user auth path.
Not exploitable due to privsep.
* Update license. md5crypt removed, bcrypt relicensed.
4-Clause license removed.
* Minor spelling fixes in the license file.
* Remove configure option due to the removal of md5crypt.
Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
rules/openssh.make | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/rules/openssh.make b/rules/openssh.make
index c801d8a6a..8f48e426e 100644
--- a/rules/openssh.make
+++ b/rules/openssh.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
#
# Paths and names
#
-OPENSSH_VERSION := 8.8p1
-OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453
+OPENSSH_VERSION := 8.9p1
+OPENSSH_MD5 := f33910174f0af52491277211e2b105bb
OPENSSH := openssh-$(OPENSSH_VERSION)
OPENSSH_SUFFIX := tar.gz
OPENSSH_URL := \
@@ -25,8 +25,8 @@ OPENSSH_URL := \
OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH)
-OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
-OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
+OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
+OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
# ----------------------------------------------------------------------------
# Prepare
@@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \
--with-privsep-user=sshd \
--with-sandbox=$(OPENSSH_SANDBOX-y) \
--$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
- --with-privsep-path=/var/run/sshd \
- --without-md5-passwords
+ --with-privsep-path=/var/run/sshd
# ----------------------------------------------------------------------------
# Target-Install
--
2.32.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1
2022-03-30 13:25 [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1 Christian Melki
@ 2022-03-30 17:48 ` Michael Olbrich
2022-03-30 18:53 ` Christian Melki
0 siblings, 1 reply; 5+ messages in thread
From: Michael Olbrich @ 2022-03-30 17:48 UTC (permalink / raw)
To: Christian Melki; +Cc: ptxdist
On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote:
> Security miss, integer overflow in the user auth path.
> Not exploitable due to privsep.
>
> * Update license. md5crypt removed, bcrypt relicensed.
> 4-Clause license removed.
> * Minor spelling fixes in the license file.
> * Remove configure option due to the removal of md5crypt.
Fails to build here with:
ssherr.c: In function 'ssh_err':
ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported on this target
make: *** [Makefile:200: ssherr.o] Error 1
The stange thing is there is a configure check for it that that one
succeeds:
checking if arm-v7a-linux-gnueabihf-gcc supports compile flag -fzero-call-used-regs=all... yes
Michael
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> ---
> rules/openssh.make | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/rules/openssh.make b/rules/openssh.make
> index c801d8a6a..8f48e426e 100644
> --- a/rules/openssh.make
> +++ b/rules/openssh.make
> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
> #
> # Paths and names
> #
> -OPENSSH_VERSION := 8.8p1
> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453
> +OPENSSH_VERSION := 8.9p1
> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb
> OPENSSH := openssh-$(OPENSSH_VERSION)
> OPENSSH_SUFFIX := tar.gz
> OPENSSH_URL := \
> @@ -25,8 +25,8 @@ OPENSSH_URL := \
>
> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH)
> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
> -OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
> +OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
>
> # ----------------------------------------------------------------------------
> # Prepare
> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \
> --with-privsep-user=sshd \
> --with-sandbox=$(OPENSSH_SANDBOX-y) \
> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
> - --with-privsep-path=/var/run/sshd \
> - --without-md5-passwords
> + --with-privsep-path=/var/run/sshd
>
> # ----------------------------------------------------------------------------
> # Target-Install
> --
> 2.32.0
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1
2022-03-30 17:48 ` Michael Olbrich
@ 2022-03-30 18:53 ` Christian Melki
2022-04-05 10:20 ` Michael Olbrich
0 siblings, 1 reply; 5+ messages in thread
From: Christian Melki @ 2022-03-30 18:53 UTC (permalink / raw)
To: Michael Olbrich; +Cc: ptxdist
On 3/30/22 19:48, Michael Olbrich wrote:
> On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote:
>> Security miss, integer overflow in the user auth path.
>> Not exploitable due to privsep.
>>
>> * Update license. md5crypt removed, bcrypt relicensed.
>> 4-Clause license removed.
>> * Minor spelling fixes in the license file.
>> * Remove configure option due to the removal of md5crypt.
>
> Fails to build here with:
>
> ssherr.c: In function 'ssh_err':
> ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported on this target
> make: *** [Makefile:200: ssherr.o] Error 1
>
> The stange thing is there is a configure check for it that that one
> succeeds:
>
> checking if arm-v7a-linux-gnueabihf-gcc supports compile flag -fzero-call-used-regs=all... yes
>
> Michael
>
Ack. Will look into it. Could you please tell me which gcc version
you've used?
I've successfully built it for an armv7-a target, but I am using 11.2.
>> Signed-off-by: Christian Melki <christian.melki@t2data.com>
>> ---
>> rules/openssh.make | 11 +++++------
>> 1 file changed, 5 insertions(+), 6 deletions(-)
>>
>> diff --git a/rules/openssh.make b/rules/openssh.make
>> index c801d8a6a..8f48e426e 100644
>> --- a/rules/openssh.make
>> +++ b/rules/openssh.make
>> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
>> #
>> # Paths and names
>> #
>> -OPENSSH_VERSION := 8.8p1
>> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453
>> +OPENSSH_VERSION := 8.9p1
>> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb
>> OPENSSH := openssh-$(OPENSSH_VERSION)
>> OPENSSH_SUFFIX := tar.gz
>> OPENSSH_URL := \
>> @@ -25,8 +25,8 @@ OPENSSH_URL := \
>>
>> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
>> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH)
>> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
>> -OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
>> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
>> +OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
>>
>> # ----------------------------------------------------------------------------
>> # Prepare
>> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \
>> --with-privsep-user=sshd \
>> --with-sandbox=$(OPENSSH_SANDBOX-y) \
>> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
>> - --with-privsep-path=/var/run/sshd \
>> - --without-md5-passwords
>> + --with-privsep-path=/var/run/sshd
>>
>> # ----------------------------------------------------------------------------
>> # Target-Install
>> --
>> 2.32.0
>>
>>
>> _______________________________________________
>> ptxdist mailing list
>> ptxdist@pengutronix.de
>> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
>>
>
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1
2022-03-30 18:53 ` Christian Melki
@ 2022-04-05 10:20 ` Michael Olbrich
2022-04-05 17:28 ` Christian Melki
0 siblings, 1 reply; 5+ messages in thread
From: Michael Olbrich @ 2022-04-05 10:20 UTC (permalink / raw)
To: Christian Melki; +Cc: ptxdist
On Wed, Mar 30, 2022 at 08:53:47PM +0200, Christian Melki wrote:
> On 3/30/22 19:48, Michael Olbrich wrote:
> > On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote:
> >> Security miss, integer overflow in the user auth path.
> >> Not exploitable due to privsep.
> >>
> >> * Update license. md5crypt removed, bcrypt relicensed.
> >> 4-Clause license removed.
> >> * Minor spelling fixes in the license file.
> >> * Remove configure option due to the removal of md5crypt.
> >
> > Fails to build here with:
> >
> > ssherr.c: In function 'ssh_err':
> > ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported on this target
> > make: *** [Makefile:200: ssherr.o] Error 1
> >
> > The stange thing is there is a configure check for it that that one
> > succeeds:
> >
> > checking if arm-v7a-linux-gnueabihf-gcc supports compile flag -fzero-call-used-regs=all... yes
> >
> > Michael
> >
>
> Ack. Will look into it. Could you please tell me which gcc version
> you've used?
> I've successfully built it for an armv7-a target, but I am using 11.2.
gcc 11.1 from OSELAS.Toolchain-2021.07.0. Or maybe this was triggered by
one of the hardening options in the platformconfig:
PTXCONF_TARGET_HARDEN_STACK_STRONG=y
PTXCONF_TARGET_HARDEN_FORTIFY=y
PTXCONF_TARGET_HARDEN_RELRO=y
PTXCONF_TARGET_HARDEN_BINDNOW=y
PTXCONF_TARGET_HARDEN_PIE=y
PTXCONF_TARGET_HARDEN_GLIBCXX_ASSERTIONS=y
Michael
> >> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> >> ---
> >> rules/openssh.make | 11 +++++------
> >> 1 file changed, 5 insertions(+), 6 deletions(-)
> >>
> >> diff --git a/rules/openssh.make b/rules/openssh.make
> >> index c801d8a6a..8f48e426e 100644
> >> --- a/rules/openssh.make
> >> +++ b/rules/openssh.make
> >> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
> >> #
> >> # Paths and names
> >> #
> >> -OPENSSH_VERSION := 8.8p1
> >> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453
> >> +OPENSSH_VERSION := 8.9p1
> >> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb
> >> OPENSSH := openssh-$(OPENSSH_VERSION)
> >> OPENSSH_SUFFIX := tar.gz
> >> OPENSSH_URL := \
> >> @@ -25,8 +25,8 @@ OPENSSH_URL := \
> >>
> >> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
> >> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH)
> >> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
> >> -OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
> >> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
> >> +OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
> >>
> >> # ----------------------------------------------------------------------------
> >> # Prepare
> >> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \
> >> --with-privsep-user=sshd \
> >> --with-sandbox=$(OPENSSH_SANDBOX-y) \
> >> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
> >> - --with-privsep-path=/var/run/sshd \
> >> - --without-md5-passwords
> >> + --with-privsep-path=/var/run/sshd
> >>
> >> # ----------------------------------------------------------------------------
> >> # Target-Install
> >> --
> >> 2.32.0
> >>
> >>
> >> _______________________________________________
> >> ptxdist mailing list
> >> ptxdist@pengutronix.de
> >> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> >>
> >
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1
2022-04-05 10:20 ` Michael Olbrich
@ 2022-04-05 17:28 ` Christian Melki
0 siblings, 0 replies; 5+ messages in thread
From: Christian Melki @ 2022-04-05 17:28 UTC (permalink / raw)
To: ptxdist
On 4/5/22 12:20, Michael Olbrich wrote:
> On Wed, Mar 30, 2022 at 08:53:47PM +0200, Christian Melki wrote:
>> On 3/30/22 19:48, Michael Olbrich wrote:
>>> On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote:
>>>> Security miss, integer overflow in the user auth path.
>>>> Not exploitable due to privsep.
>>>>
>>>> * Update license. md5crypt removed, bcrypt relicensed.
>>>> 4-Clause license removed.
>>>> * Minor spelling fixes in the license file.
>>>> * Remove configure option due to the removal of md5crypt.
>>>
>>> Fails to build here with:
>>>
>>> ssherr.c: In function 'ssh_err':
>>> ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported on this target
>>> make: *** [Makefile:200: ssherr.o] Error 1
>>>
>>> The stange thing is there is a configure check for it that that one
>>> succeeds:
>>>
>>> checking if arm-v7a-linux-gnueabihf-gcc supports compile flag -fzero-call-used-regs=all... yes
>>>
>>> Michael
>>>
>>
>> Ack. Will look into it. Could you please tell me which gcc version
>> you've used?
>> I've successfully built it for an armv7-a target, but I am using 11.2.
>
> gcc 11.1 from OSELAS.Toolchain-2021.07.0. Or maybe this was triggered by
> one of the hardening options in the platformconfig:
>
> PTXCONF_TARGET_HARDEN_STACK_STRONG=y
> PTXCONF_TARGET_HARDEN_FORTIFY=y
> PTXCONF_TARGET_HARDEN_RELRO=y
> PTXCONF_TARGET_HARDEN_BINDNOW=y
> PTXCONF_TARGET_HARDEN_PIE=y
> PTXCONF_TARGET_HARDEN_GLIBCXX_ASSERTIONS=y
>
> Michael
>
I have approx the same hardening enabled.
It's a new function. Introduced in GCC11 I believe?
Don't remember but I don't think ARM support was really that complete
early on. x86_64 and aarch64 should work though.
Anyway. Did the patch help?
Regards,
Christian
>>>> Signed-off-by: Christian Melki <christian.melki@t2data.com>
>>>> ---
>>>> rules/openssh.make | 11 +++++------
>>>> 1 file changed, 5 insertions(+), 6 deletions(-)
>>>>
>>>> diff --git a/rules/openssh.make b/rules/openssh.make
>>>> index c801d8a6a..8f48e426e 100644
>>>> --- a/rules/openssh.make
>>>> +++ b/rules/openssh.make
>>>> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
>>>> #
>>>> # Paths and names
>>>> #
>>>> -OPENSSH_VERSION := 8.8p1
>>>> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453
>>>> +OPENSSH_VERSION := 8.9p1
>>>> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb
>>>> OPENSSH := openssh-$(OPENSSH_VERSION)
>>>> OPENSSH_SUFFIX := tar.gz
>>>> OPENSSH_URL := \
>>>> @@ -25,8 +25,8 @@ OPENSSH_URL := \
>>>>
>>>> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
>>>> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH)
>>>> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
>>>> -OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
>>>> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
>>>> +OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
>>>>
>>>> # ----------------------------------------------------------------------------
>>>> # Prepare
>>>> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \
>>>> --with-privsep-user=sshd \
>>>> --with-sandbox=$(OPENSSH_SANDBOX-y) \
>>>> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
>>>> - --with-privsep-path=/var/run/sshd \
>>>> - --without-md5-passwords
>>>> + --with-privsep-path=/var/run/sshd
>>>>
>>>> # ----------------------------------------------------------------------------
>>>> # Target-Install
>>>> --
>>>> 2.32.0
>>>>
>>>>
>>>> _______________________________________________
>>>> ptxdist mailing list
>>>> ptxdist@pengutronix.de
>>>> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
>>>>
>>>
>>
>>
>
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-04-05 17:30 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-30 13:25 [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1 Christian Melki
2022-03-30 17:48 ` Michael Olbrich
2022-03-30 18:53 ` Christian Melki
2022-04-05 10:20 ` Michael Olbrich
2022-04-05 17:28 ` Christian Melki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox