[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1107252: marked as done (bookworm-pu: package corosync/3.1.7-1+deb12u1)

Your message dated Sat, 06 Sep 2025 12:14:50 +0100
with message-id <ee4c0876608d99eb3f8b333b556fbd92e7a652eb.camel@adam-barratt.org.uk>
and subject line Closing p-u requests for fixes included in 12.12
has caused the Debian Bug report #1107252,
regarding bookworm-pu: package corosync/3.1.7-1+deb12u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1107252: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107252
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: corosync@packages.debian.org, wferi@debian.org
Control: affects -1 + src:corosync
User: release.debian.org@packages.debian.org
Usertags: pu

Fixes a minor security issue, debdiff below.

Cheers,
        Moritz

diff -Nru corosync-3.1.7/debian/changelog corosync-3.1.7/debian/changelog
--- corosync-3.1.7/debian/changelog	2023-01-15 15:00:42.000000000 +0100
+++ corosync-3.1.7/debian/changelog	2025-05-18 21:16:40.000000000 +0200
@@ -1,3 +1,9 @@
+corosync (3.1.7-1+deb12u1) bookworm; urgency=medium
+
+  * CVE-2025-30472 (Closes: #1102006)
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Sun, 18 May 2025 21:16:40 +0200
+
 corosync (3.1.7-1) unstable; urgency=medium
 
   * [f3d69c9] New upstream release (3.1.7)
diff -Nru corosync-3.1.7/debian/patches/CVE-2025-30472.patch corosync-3.1.7/debian/patches/CVE-2025-30472.patch
--- corosync-3.1.7/debian/patches/CVE-2025-30472.patch	1970-01-01 01:00:00.000000000 +0100
+++ corosync-3.1.7/debian/patches/CVE-2025-30472.patch	2025-05-18 21:16:40.000000000 +0200
@@ -0,0 +1,63 @@
+From 7839990f9cdf34e55435ed90109e82709032466a Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Mon, 24 Mar 2025 12:05:08 +0100
+Subject: [PATCH] totemsrp: Check size of orf_token msg
+
+orf_token message is stored into preallocated array on endian convert
+so carefully crafted malicious message can lead to crash of corosync.
+
+Solution is to check message size beforehand.
+
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+---
+ exec/totemsrp.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- corosync-3.1.7.orig/exec/totemsrp.c
++++ corosync-3.1.7/exec/totemsrp.c
+@@ -3679,12 +3679,20 @@ static int check_orf_token_sanity(
+ 	const struct totemsrp_instance *instance,
+ 	const void *msg,
+ 	size_t msg_len,
++	size_t max_msg_len,
+ 	int endian_conversion_needed)
+ {
+ 	int rtr_entries;
+ 	const struct orf_token *token = (const struct orf_token *)msg;
+ 	size_t required_len;
+ 
++	if (msg_len > max_msg_len) {
++		log_printf (instance->totemsrp_log_level_security,
++		    "Received orf_token message is too long...  ignoring.");
++
++		return (-1);
++	}
++
+ 	if (msg_len < sizeof(struct orf_token)) {
+ 		log_printf (instance->totemsrp_log_level_security,
+ 		    "Received orf_token message is too short...  ignoring.");
+@@ -3698,6 +3706,13 @@ static int check_orf_token_sanity(
+ 		rtr_entries = token->rtr_list_entries;
+ 	}
+ 
++	if (rtr_entries > RETRANSMIT_ENTRIES_MAX) {
++		log_printf (instance->totemsrp_log_level_security,
++		    "Received orf_token message rtr_entries is corrupted...  ignoring.");
++
++		return (-1);
++	}
++
+ 	required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
+ 	if (msg_len < required_len) {
+ 		log_printf (instance->totemsrp_log_level_security,
+@@ -3866,7 +3881,8 @@ static int message_handler_orf_token (
+ 	"Time since last token %0.4f ms", ((float)tv_diff) / 1000000.0);
+ #endif
+ 
+-	if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) {
++	if (check_orf_token_sanity(instance, msg, msg_len, sizeof(token_storage),
++	    endian_conversion_needed) == -1) {
+ 		return (0);
+ 	}
+ 
diff -Nru corosync-3.1.7/debian/patches/series corosync-3.1.7/debian/patches/series
--- corosync-3.1.7/debian/patches/series	2023-01-15 13:41:46.000000000 +0100
+++ corosync-3.1.7/debian/patches/series	2025-05-18 21:16:40.000000000 +0200
@@ -2,3 +2,4 @@
 Enable-PrivateTmp-in-the-systemd-service-files.patch
 Make-the-example-config-valid.patch
 Revert-logrotate-Use-copytruncate-method-by-default.patch
+CVE-2025-30472.patch

--- End Message ---
--- Begin Message --- 
Package: release.debian.org
Version: 12.12

Hi,

Each of the updates referenced by these requests was included in
today's 12.12 point release for bookworm.

Regards,

Adam

--- End Message ---
Reply to: