From 443c10018cb1e33cd6a054c32eb62881f1dcfca2 Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar Date: Wed, 24 Jan 2024 13:37:20 -0500 Subject: [PATCH] Update advisory format and introduce some automation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Simplify the advisory format by dropping the -Backport tags and instead stick to using just the -Commit tags. To identify backports, put a substring of git-describe into the release version in the brackets next to the commit ref. This way, it not only identifies that the fix (or regression) is on the release/2.YY/master branch, it also disambiguates regressions/fixes in the branch from those in the tarball. Add a README to make it easier for consumers to understand the format. Additionally, the Release wiki needs to be updated to inform the release manager to: 1. Generate a NEWS snipped from the advisories directory AND 2. on release/2.YY/master, replace the advisories directory with a text file pointing to the advisories directory in master so that we don't have to update multiple locations. Signed-off-by: Siddhesh Poyarekar Reviewed-by: Andreas K. Hüttel --- advisories/GLIBC-SA-2023-0001 | 2 +- advisories/GLIBC-SA-2023-0002 | 6 +-- advisories/GLIBC-SA-2023-0003 | 10 ++--- advisories/GLIBC-SA-2023-0004 | 10 ++--- advisories/GLIBC-SA-2023-0005 | 22 +++++---- advisories/README | 73 ++++++++++++++++++++++++++++++ scripts/process-advisories.sh | 85 +++++++++++++++++++++++++++++++++++ scripts/process-fixed-cves.sh | 41 ----------------- 8 files changed, 182 insertions(+), 67 deletions(-) create mode 100644 advisories/README create mode 100755 scripts/process-advisories.sh delete mode 100755 scripts/process-fixed-cves.sh diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 index 12b4f8edb8..3d19c91b6a 100644 --- a/advisories/GLIBC-SA-2023-0001 +++ b/advisories/GLIBC-SA-2023-0001 @@ -11,4 +11,4 @@ CVE-Id: CVE-2023-25139 Public-Date: 2023-02-02 Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) -Fix-Backport: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37) +Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 index 32e45f524f..5122669a64 100644 --- a/advisories/GLIBC-SA-2023-0002 +++ b/advisories/GLIBC-SA-2023-0002 @@ -10,6 +10,6 @@ CVE-Id: CVE-2023-4527 Public-Date: 2023-09-12 Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) -Fix-Backport: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36) -Fix-Backport: b7529346025a130fee483d42178b5c118da971bb (2.37) -Fix-Backport: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38) +Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) +Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) +Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 index 0950dc0792..d3aef80348 100644 --- a/advisories/GLIBC-SA-2023-0003 +++ b/advisories/GLIBC-SA-2023-0003 @@ -8,8 +8,8 @@ arbitrary memory. CVE-Id: CVE-2023-4806 Public-Date: 2023-09-12 Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) -Fix-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34) -Fix-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35) -Fix-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36) -Fix-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37) -Fix-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38) +Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) +Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) +Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) +Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) +Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 index cba13db38f..5286a7aa54 100644 --- a/advisories/GLIBC-SA-2023-0004 +++ b/advisories/GLIBC-SA-2023-0004 @@ -9,8 +9,8 @@ CVE-Id: CVE-2023-4911 Public-Date: 2023-10-03 Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) -Fix-Backport: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34) -Fix-Backport: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35) -Fix-Backport: 22955ad85186ee05834e47e665056148ca07699c (2.36) -Fix-Backport: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37) -Fix-Backport: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38) +Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) +Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) +Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) +Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) +Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 index a518af803a..cc4eb90b82 100644 --- a/advisories/GLIBC-SA-2023-0005 +++ b/advisories/GLIBC-SA-2023-0005 @@ -6,15 +6,13 @@ flags set. CVE-Id: CVE-2023-5156 Public-Date: 2023-09-25 -Vulnerable-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (pre-2.39) -Fix-Commit: ec6b95c3303c700eb89eebeda2d7264cc184a796 (2.39) -Vulnerable-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34) -Vulnerable-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35) -Vulnerable-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36) -Vulnerable-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37) -Vulnerable-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38) -Fix-Backport: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34) -Fix-Backport: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35) -Fix-Backport: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36) -Fix-Backport: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37) -Fix-Backport: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38) +Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) +Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) +Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) +Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) +Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) +Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) +Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) +Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) +Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) +Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) diff --git a/advisories/README b/advisories/README new file mode 100644 index 0000000000..94e68b1350 --- /dev/null +++ b/advisories/README @@ -0,0 +1,73 @@ +GNU C Library Security Advisory Format +====================================== + +Security advisories in this directory follow a simple git commit log +format, with a heading and free-format description augmented with tags +to allow parsing key information. References to code changes are +specific to the glibc repository and follow a specific format: + + Tag-name: (release-version) + +The indicates a specific commit in the repository. The +release-version indicates the publicly consumable release in which this +commit is known to exist. The release-version is derived from the +git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and +is of the form 2.34-NNN. If the -NNN suffix is absent, it means that +the change is in that release tarball, otherwise the change is on the +release/2.YY/master branch and not in any released tarball. + +The following tags are currently being used: + +CVE-Id: +This is the CVE-Id assigned under the CVE Program +(https://www.cve.org/). + +Public-Date: +The date this issue became publicly known. + +Vulnerable-Commit: +The commit that introduced this vulnerability. There could be multiple +entries, one for each release branch in the glibc repository; the +release-version portion of this tag should tell you which branch this is +on. + +Fix-Commit: +The commit that fixed this vulnerability. There could be multiple +entries for each release branch in the glibc repository, indicating that +all of those commits contributed to fixing that issue in each of those +branches. + +Adding an Advisory +------------------ + +An advisory for a CVE needs to be added on the master branch in two steps: + +1. Add the text of the advisory without any Fix-Commit tags along with + the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. + The advisories directory does not exist in release branches, so keep + the advisory text commit distinct from the code changes, to ease + backports. Ask for the GLIBC-SA advisory number from the security + team. + +2. Finish all backports on release branches and then back on the msater + branch, add all commit refs to the advisory using the Fix-Commit + tags. Don't bother adding the release-version subscript since the + next step will overwrite it. + +3. Run the process-advisories.sh script in the scripts directory on the + advisory: + + scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN + + (replace YYYY-NNNN with the actual advisory number). + +4. Verify the updated advisory and push the result. + +Getting a NEWS snippet from advisories +-------------------------------------- + +Run: + + scripts/process-advisories.sh news + +and copy the content into the NEWS file. diff --git a/scripts/process-advisories.sh b/scripts/process-advisories.sh new file mode 100755 index 0000000000..a520fab5e6 --- /dev/null +++ b/scripts/process-advisories.sh @@ -0,0 +1,85 @@ +#!/bin/bash -e +# Copyright The GNU Toolchain Authors. +# This file is part of the GNU C Library. +# +# The GNU C Library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# The GNU C Library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with the GNU C Library; if not, see +# . + +if ! [ -d advisories ]; then + echo "error: Run me from the toplevel directory of the glibc repository." + exit 1 +fi + +command=$1 + +usage () { + cat >&2 <. - -if ! [ -d advisories ]; then - echo "error: Run me from the toplevel directory of the glibc repository." - exit 1 -fi - -release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#") -minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - | - grep -v "^#") - -if [ $release = "\"development\"" ]; then - cur_rel=2.$((minor + 1)) -else - cur_rel=2.$minor -fi - -for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do - echo -e " $(basename $f):" - cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f) - echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do - echo " $line" - done - echo -done