From patchwork Wed Jan 24 19:58:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddhesh Poyarekar X-Patchwork-Id: 1890405 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.a=rsa-sha256 header.s=default header.b=MLqlj/cm; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TKvt66vy7z1yS7 for ; Thu, 25 Jan 2024 06:59:10 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id A9AFB3858D38 for ; Wed, 24 Jan 2024 19:59:08 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A9AFB3858D38 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1706126348; bh=+RqigAZ9D1KyS0zqqKJyXJYyWlPPUWHx5DuixmUS3DY=; h=From:To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From; b=MLqlj/cmM1TipqmMTlfJcKSGhv1kYgJLAMAIBUsXJ3EaeYrnnqi9Duii1ntcrI/k7 SXbCax6OiR54Hzu3cypz+mLHCmiJDeEH0BKCJrZ+ROdPWzP5rOA1o3K/tj5EM3MV6N Gk+6fPBKJ9TEsGYroqfQUMmpuHpoumVkqWv8hkaA= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from dragonfly.birch.relay.mailchannels.net (dragonfly.birch.relay.mailchannels.net [23.83.209.51]) by sourceware.org (Postfix) with ESMTPS id 503963858D38 for ; Wed, 24 Jan 2024 19:58:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 503963858D38 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=sourceware.org Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=sourceware.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 503963858D38 Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.209.51 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706126326; cv=pass; b=pnbJgFcUOPvn/qQrRXOzAXTFjwV7m1QzYWOH5HtSydBphFUQJKX3iov2cbgxGVQ/ZeUE6AMLIj/CI/aeHbOqylmB/KtPRR/quaqiOPFW7jJd2A5nZPgstmyO7nzRzKdojdD5Ic0jxDzNgKvgLRRoQh+LMDrkaJbU9WTZHM9txkY= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706126326; c=relaxed/simple; bh=OUVIZ5I+LfNA9FmqVelGuiVBdYnwR5XWYIe+fMBmWGQ=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=YF88UemeTy2DV3kgy299bScyQENT3nZBJzRGWDCwJ8HOwCkNlmkPhJUnN+OQh/N9NqQz1qcFTVJfs1dxMmjxiFVTfw0KoxE9rAlU1Q1rmSE3V82jtLmyvjP83ZfS1XdLf1FTZU/fOE60wPT9+AIIeZIhJzOCn9OfQ+HpiBKXo38= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 27788102297; Wed, 24 Jan 2024 19:58:42 +0000 (UTC) Received: from pdx1-sub0-mail-a212.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 7A637101E0A; Wed, 24 Jan 2024 19:58:41 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1706126321; a=rsa-sha256; cv=none; b=SZoeTwgWgdBkSrn8x9RJdmzCbyUT7QW6B9QZM8sZqf920JNfiK3jJyHgHdoC8ZOF7Pn8kE iz+ECLVRMQcX1QDu2oyu9O0gy05fDK6qohTXei035cHYPGBVMvVQPrWrBPEaMTp9845voM UXCOZmLT6A86uA+pUc+L5I1WCUJg/tOBfU3NNynJykjIi/n+mps/tzcAJUF18P6IhrC0VR PdS1TMiDM5MHjGVjmDLff+LOUSIGzvDC0xl8iuBAuBCgyNyywQ0+30dHCdTq370fKmvmqT GLEpQvmsoqA3AJMWK7IvVrM20JkVYPVyMd4Tq7aKWbw0lPKBIcjSqHdKoznHmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1706126321; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=+RqigAZ9D1KyS0zqqKJyXJYyWlPPUWHx5DuixmUS3DY=; b=0oV+oMwX8DZUmxCiMnvNF29qWW/TO24/k6eF1gxVFHbg0Jj7UbGSq5F+e1aCAG/jRQBQ4v Xr15TQVYBqAUw8w3sHir9I7QB5/+utKjO7zM8kZ/MeoYljpO0FZ0SrEHB71mtVG64lTozV jThWnxpDqWKE9fVXQx7r4nbZ9jU/ZF5olwd5rHLD2T2ZQSgKL8uLB/9xTVTIr5TYXJNeJJ A4fwn8qm7JUx8FTcVxeJydbBr73Jxj9pHGj287wP9ChTo/+rhDuQrhZtd+i1rCC5le/7iM +y4NNY/TfcdUgS2BbRAMOzzzdXZHI5/5DSji+1CkmL1IfGkWbByTwZj8iVwp8g== ARC-Authentication-Results: i=1; rspamd-76cc9994fd-2cdmv; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Harmony-Imminent: 7b93ded23a37585f_1706126321816_2678060063 X-MC-Loop-Signature: 1706126321816:3047152167 X-MC-Ingress-Time: 1706126321815 Received: from pdx1-sub0-mail-a212.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.127.213.198 (trex/6.9.2); Wed, 24 Jan 2024 19:58:41 +0000 Received: from fedora.redhat.com (bras-base-toroon4834w-grc-23-76-68-24-30.dsl.bell.ca [76.68.24.30]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a212.dreamhost.com (Postfix) with ESMTPSA id 4TKvsX5tpNzFc; Wed, 24 Jan 2024 11:58:40 -0800 (PST) From: Siddhesh Poyarekar To: libc-alpha@sourceware.org Cc: carlos@redhat.com, adhemerval.zanella@linaro.org, fweimer@redhat.com, dilfridge@gentoo.org Subject: [PATCH] Update advisory format and introduce some automation Date: Wed, 24 Jan 2024 14:58:30 -0500 Message-ID: <20240124195830.137143-1-siddhesh@sourceware.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Spam-Status: No, score=-1172.0 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_NONE, KAM_DMARC_STATUS, KAM_LOTSOFHASH, KAM_SHORT, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_SOFTFAIL, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Simplify the advisory format by dropping the -Backport tags and instead stick to using just the -Commit tags. To identify backports, put a substring of git-describe into the release version in the brackets next to the commit ref. This way, it not only identifies that the fix (or regression) is on the release/2.YY/master branch, it also disambiguates regressions/fixes in the branch from those in the tarball. Add a README to make it easier for consumers to understand the format. Additionally, the Release wiki needs to be updated to inform the release manager to: 1. Generate a NEWS snipped from the advisories directory AND 2. on release/2.YY/master, replace the advisories directory with a text file pointing to the advisories directory in master so that we don't have to update multiple locations. Signed-off-by: Siddhesh Poyarekar --- advisories/GLIBC-SA-2023-0001 | 2 +- advisories/GLIBC-SA-2023-0002 | 6 +-- advisories/GLIBC-SA-2023-0003 | 10 ++--- advisories/README | 70 +++++++++++++++++++++++++++++ scripts/process-advisories.sh | 85 +++++++++++++++++++++++++++++++++++ scripts/process-fixed-cves.sh | 41 ----------------- 6 files changed, 164 insertions(+), 50 deletions(-) create mode 100644 advisories/README create mode 100755 scripts/process-advisories.sh delete mode 100755 scripts/process-fixed-cves.sh diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 index 9dded7b9c3..3d19c91b6a 100644 --- a/advisories/GLIBC-SA-2023-0001 +++ b/advisories/GLIBC-SA-2023-0001 @@ -11,4 +11,4 @@ CVE-Id: CVE-2023-25139 Public-Date: 2023-02-02 Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) -Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37) +Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 index 40dfe9fb97..5122669a64 100644 --- a/advisories/GLIBC-SA-2023-0002 +++ b/advisories/GLIBC-SA-2023-0002 @@ -10,6 +10,6 @@ CVE-Id: CVE-2023-4527 Public-Date: 2023-09-12 Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) -Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36) -Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37) -Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38) +Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) +Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) +Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 index 57c317cf03..d3aef80348 100644 --- a/advisories/GLIBC-SA-2023-0003 +++ b/advisories/GLIBC-SA-2023-0003 @@ -8,8 +8,8 @@ arbitrary memory. CVE-Id: CVE-2023-4806 Public-Date: 2023-09-12 Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) -Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34) -Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35) -Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36) -Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37) -Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38) +Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) +Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) +Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) +Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) +Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) diff --git a/advisories/README b/advisories/README new file mode 100644 index 0000000000..8bf463b5fc --- /dev/null +++ b/advisories/README @@ -0,0 +1,70 @@ +GNU C Library Security Advisory Format +====================================== + +Security advisories in this directory follow a simple git commit log +format, with a heading and free-format description augmented with tags +to allow parsing key information. References to code changes are +specific to the glibc repository and follow a specific format: + + Tag-name: (release-version) + +The indicates a specific commit in the repository. The +release-version indicates the publicly consumable release in which this +commit is known to exist. For a simple release-version, e.g. 2.34, this +change is present in release tarballs. For release-version of the form +2.34-NNN (e.g. 2.34-42), the change is on the release/2.34/master +branch and not in any released tarball. + +The following tags are currently being used: + +CVE-Id: +This is the CVE-Id assigned under the CVE Program +(https://www.cve.org/). + +Public-Date: +The date this issue became publicly known. + +Vulnerable-Commit: +The commit that introduced this vulnerability. There could be multiple +entries, one for each release branch in the glibc repository; the +release-version portion of this tag should tell you which branch this is +on. + +Fix-Commit: +The commit that fixed this vulnerability. There could be multiple +entries for each release branch in the glibc repository, indicating that +all of those commits contributed to fixing that issue in each of those +branches. + +Adding an Advisory +------------------ + +An advisory for a CVE needs to be added in two steps: + +1. Add the text of the advisory without any Fix-Commit tags along with + the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. + The advisories directory does not exist in branches, so keep the + advisory text commit distinct from the code changes, to ease + backports. Ask for the GLIBC-SA advisory number from the security + team. + +2. Finish all backports and then add all commits to the advisory using + the Fix-Commit tags. Don't add the release-version subscript. + +3. Run the process-advisories.sh script in the scripts directory on the + advisory: + + scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN + + (replace YYYY-NNNN with the actual advisory number). + +4. Verify the updated advisory and push the result. + +Getting a NEWS snippet from advisories +-------------------------------------- + +Run: + + scripts/process-advisories.sh news + +and copy the content into the NEWS file. diff --git a/scripts/process-advisories.sh b/scripts/process-advisories.sh new file mode 100755 index 0000000000..a520fab5e6 --- /dev/null +++ b/scripts/process-advisories.sh @@ -0,0 +1,85 @@ +#!/bin/bash -e +# Copyright The GNU Toolchain Authors. +# This file is part of the GNU C Library. +# +# The GNU C Library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# The GNU C Library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with the GNU C Library; if not, see +# . + +if ! [ -d advisories ]; then + echo "error: Run me from the toplevel directory of the glibc repository." + exit 1 +fi + +command=$1 + +usage () { + cat >&2 <. - -if ! [ -d advisories ]; then - echo "error: Run me from the toplevel directory of the glibc repository." - exit 1 -fi - -release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#") -minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - | - grep -v "^#") - -if [ $release = "\"development\"" ]; then - cur_rel=2.$((minor + 1)) -else - cur_rel=2.$minor -fi - -for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do - echo -e " $(basename $f):" - cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f) - echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do - echo " $line" - done - echo -done