diff --git a/CVE-2022-36113.patch b/CVE-2022-36113.patch new file mode 100644 index 0000000000000000000000000000000000000000..6265226e2ac32c5c1179d74fa2ce82b38658324b --- /dev/null +++ b/CVE-2022-36113.patch @@ -0,0 +1,56 @@ +Refer: +https://github.com/rust-lang/cargo/commit/15f1e4b0bf4b4fc20369e0a85d9b77957c4dd52a +https://build.opensuse.org/package/show/SUSE:SLE-15-SP3:Update/rust1.62 + +From 15f1e4b0bf4b4fc20369e0a85d9b77957c4dd52a Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Thu, 18 Aug 2022 17:17:19 +0200 +Subject: [PATCH] CVE-2022-36113: avoid unpacking .cargo-ok from the crate + + +--- + src/cargo/sources/registry/mod.rs | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/src/cargo/sources/registry/mod.rs b/src/tools/cargo/src/cargo/sources/registry/mod.rs +index 1df7738e3..03675d16f 100644 +--- a/src/cargo/sources/registry/mod.rs ++++ b/src/tools/cargo/src/cargo/sources/registry/mod.rs +@@ -645,6 +645,13 @@ impl<'cfg> RegistrySource<'cfg> { + prefix + ) + } ++ // Prevent unpacking the lockfile from the crate itself. ++ if entry_path ++ .file_name() ++ .map_or(false, |p| p == PACKAGE_SOURCE_LOCK) ++ { ++ continue; ++ } + // Unpacking failed + let mut result = entry.unpack_in(parent).map_err(anyhow::Error::from); + if cfg!(windows) && restricted_names::is_windows_reserved_path(&entry_path) { +@@ -660,16 +667,14 @@ impl<'cfg> RegistrySource<'cfg> { + .with_context(|| format!("failed to unpack entry at `{}`", entry_path.display()))?; + } + +- // The lock file is created after unpacking so we overwrite a lock file +- // which may have been extracted from the package. ++ // Now that we've finished unpacking, create and write to the lock file to indicate that ++ // unpacking was successful. + let mut ok = OpenOptions::new() +- .create(true) ++ .create_new(true) + .read(true) + .write(true) + .open(&path) + .with_context(|| format!("failed to open `{}`", path.display()))?; +- +- // Write to the lock file to indicate that unpacking was successful. + write!(ok, "ok")?; + + Ok(unpack_dir.to_path_buf()) +-- +2.37.3 + + diff --git a/CVE-2022-36114.patch b/CVE-2022-36114.patch new file mode 100644 index 0000000000000000000000000000000000000000..1fe56c2c49c849e367c597deaadf20afc42bef62 --- /dev/null +++ b/CVE-2022-36114.patch @@ -0,0 +1,109 @@ +Refer: +https://github.com/rust-lang/cargo/commit/2b68d3c07a4a056264dc006ecb9f1354a0679cd3 +https://build.opensuse.org/package/show/SUSE:SLE-15-SP3:Update/rust1.62 + +From 2b68d3c07a4a056264dc006ecb9f1354a0679cd3 Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Thu, 18 Aug 2022 17:45:45 +0200 +Subject: [PATCH] CVE-2022-36114: limit the maximum unpacked size of a crate to + 512MB + +This gives users of custom registries the same protections, using the +same size limit that crates.io uses. + +`LimitErrorReader` code copied from crates.io. +--- + src/cargo/sources/registry/mod.rs | 6 +++++- + src/cargo/util/io.rs | 27 +++++++++++++++++++++++++++ + src/cargo/util/mod.rs | 2 ++ + 3 files changed, 34 insertions(+), 1 deletion(-) + create mode 100644 src/cargo/util/io.rs + +diff --git a/src/cargo/sources/registry/mod.rs b/src/tools/cargo/src/cargo/sources/registry/mod.rs +index fc9c29510..1df7738e3 100644 +--- a/src/cargo/sources/registry/mod.rs ++++ b/src/tools/cargo/src/cargo/sources/registry/mod.rs +@@ -182,7 +182,9 @@ use crate::util::hex; + use crate::util::hex; + use crate::util::interning::InternedString; + use crate::util::into_url::IntoUrl; +-use crate::util::{restricted_names, CargoResult, Config, Filesystem, OptVersionReq}; ++use crate::util::{ ++ restricted_names, CargoResult, Config, Filesystem, LimitErrorReader, OptVersionReq, ++}; + + const PACKAGE_SOURCE_LOCK: &str = ".cargo-ok"; + pub const CRATES_IO_INDEX: &str = "https://github.com/rust-lang/crates.io-index"; +@@ -193,6 +195,7 @@ const VERSION_TEMPLATE: &str = "{version}"; + const PREFIX_TEMPLATE: &str = "{prefix}"; + const LOWER_PREFIX_TEMPLATE: &str = "{lowerprefix}"; + const CHECKSUM_TEMPLATE: &str = "{sha256-checksum}"; ++const MAX_UNPACK_SIZE: u64 = 512 * 1024 * 1024; + + /// A "source" for a local (see `local::LocalRegistry`) or remote (see + /// `remote::RemoteRegistry`) registry. +@@ -617,6 +620,7 @@ impl<'cfg> RegistrySource<'cfg> { + } + } + let gz = GzDecoder::new(tarball); ++ let gz = LimitErrorReader::new(gz, MAX_UNPACK_SIZE); + let mut tar = Archive::new(gz); + let prefix = unpack_dir.file_name().unwrap(); + let parent = unpack_dir.parent().unwrap(); +diff --git a/src/cargo/util/io.rs b/src/tools/cargo/src/cargo/util/io.rs +new file mode 100644 +index 000000000..f62672db0 +--- /dev/null ++++ b/src/tools/cargo/src/cargo/util/io.rs +@@ -0,0 +1,27 @@ ++use std::io::{self, Read, Take}; ++ ++#[derive(Debug)] ++pub struct LimitErrorReader { ++ inner: Take, ++} ++ ++impl LimitErrorReader { ++ pub fn new(r: R, limit: u64) -> LimitErrorReader { ++ LimitErrorReader { ++ inner: r.take(limit), ++ } ++ } ++} ++ ++impl Read for LimitErrorReader { ++ fn read(&mut self, buf: &mut [u8]) -> io::Result { ++ match self.inner.read(buf) { ++ Ok(0) if self.inner.limit() == 0 => Err(io::Error::new( ++ io::ErrorKind::Other, ++ "maximum limit reached when reading", ++ )), ++ e => e, ++ } ++ } ++} ++ +diff --git a/src/cargo/util/mod.rs b/src/tools/cargo/src/cargo/util/mod.rs +index 4b8604f92..dd695fbff 100644 +--- a/src/cargo/util/mod.rs ++++ b/src/tools/cargo/src/cargo/util/mod.rs +@@ -14,6 +14,7 @@ pub use self::hasher::StableHasher; + pub use self::hex::{hash_u64, short_hash, to_hex}; + pub use self::into_url::IntoUrl; + pub use self::into_url_with_base::IntoUrlWithBase; ++pub(crate) use self::io::LimitErrorReader; + pub use self::lev_distance::{closest, closest_msg, lev_distance}; + pub use self::lockserver::{LockServer, LockServerClient, LockServerStarted}; + pub use self::progress::{Progress, ProgressStyle}; +@@ -44,6 +45,7 @@ pub mod important_paths; + pub mod interning; + pub mod into_url; + mod into_url_with_base; ++mod io; + pub mod job; + pub mod lev_distance; + mod lockserver; +-- +2.37.3 + + diff --git a/rust.spec b/rust.spec index 4cca01c51b2d84d811b98fcb737f789c3bef6928..c320610b595e16a0ec9508221bfa68bd80e7993f 100644 --- a/rust.spec +++ b/rust.spec @@ -11,7 +11,7 @@ %bcond_without lldb Name: rust Version: 1.60.0 -Release: 3 +Release: 4 Summary: The Rust Programming Language License: (ASL 2.0 or MIT) and (BSD and MIT) URL: https://www.rust-lang.org @@ -30,6 +30,8 @@ Patch0004: fix-a-println-wrong-format.patch Patch0006: 0001-Add-base-loongarch64-support-for-rust-1.60.0.patch Patch0007: 0002-vendor-Add-loongarch64-support-for-rust-1.60.0.patch Patch0008: CVE-2024-24577.patch +Patch3000: CVE-2022-36113.patch +Patch3001: CVE-2022-36114.patch %{lua: function rust_triple(arch) local abi = "gnu" if arch == "armv7hl" then @@ -264,6 +266,8 @@ sed -i.try-python -e '/^try python3 /i try "%{python}" "$@"' ./configure %patch0007 -p1 %endif %patch0008 -p1 +%patch3000 -p1 +%patch3001 -p1 rm -rf vendor/curl-sys/curl/ rm -rf vendor/jemalloc-sys/jemalloc/ rm -rf vendor/libssh2-sys/libssh2/ @@ -490,6 +494,9 @@ export %{rust_env} %{_mandir}/man1/cargo*.1* %changelog +* Thu Jun 27 2024 wangkai <13474090681@163.com> - 1.60.0-4 +- Fix CVE-2022-36113, CVE-2022-36114 + * Sat Feb 17 2024 wangkai <13474090681@163.com> - 1.60.0-3 - Fix CVE-2024-24577