Move CVE information into advisories directory

  One of the requirements to becoming a CVE Numbering Authority (CNA) is
to publish advisories.  Do this by maintaining a file for each CVE fixed
in the advisories directory in the source tree.  Links to the advisories
can then be shared as:

https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/CVE-YYYY-NNNN

In future, backports up to glibc 2.39 should also include backport of
the relevant advisory file.

The file format at the moment is rudimentary and derives from the git
commit format, i.e. a subject line and a potentially multi-paragraph
description and then tags to describe some meta information.  This is a
loose format at the moment and could change as we evolve this.

Also add a script process-fixed-cves.sh that processes these advisories
and generates a list to add to NEWS at release time.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---

Once this has consensus, I'll generate advisory files for all CVEs up to
v2.34 on the master branch.  I'll post a separate patch for older
branches up to 2.34, since they will have a different Fixed-by and
probably shouldn't include Fixed-releases:.

 NEWS                          | 24 +++++-------------------
 advisories/CVE-2023-4527      | 12 ++++++++++++
 advisories/CVE-2023-4806      | 10 ++++++++++
 advisories/CVE-2023-4911      | 11 +++++++++++
 advisories/CVE-2023-5156      | 10 ++++++++++
 scripts/process-fixed-cves.sh | 34 ++++++++++++++++++++++++++++++++++
 6 files changed, 82 insertions(+), 19 deletions(-)
 create mode 100644 advisories/CVE-2023-4527
 create mode 100644 advisories/CVE-2023-4806
 create mode 100644 advisories/CVE-2023-4911
 create mode 100644 advisories/CVE-2023-5156
 create mode 100755 scripts/process-fixed-cves.sh
  

* Siddhesh Poyarekar:

> One of the requirements to becoming a CVE Numbering Authority (CNA) is
> to publish advisories.  Do this by maintaining a file for each CVE fixed
> in the advisories directory in the source tree.  Links to the advisories
> can then be shared as:
>
> https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/CVE-YYYY-NNNN

I think we should use our own identifiers (GLIBC-SA-2023-001 etc.)
instead of CVE IDs.  CVE IDs can change due to duplicates, typos that
lead to rejection etc., and I don't think Gitweb follows symbolic links
in the repository (and we shouldn't check them in anyway because they
are confusing).

> In future, backports up to glibc 2.39 should also include backport of
> the relevant advisory file.

Should we replace the directory with a reference to the master branch
upon branching for the release?  This way, the information is just in
one place.

> diff --git a/advisories/CVE-2023-4527 b/advisories/CVE-2023-4527
> new file mode 100644
> index 0000000000..9bb4957501
> --- /dev/null
> +++ b/advisories/CVE-2023-4527
> @@ -0,0 +1,12 @@
> +getaddrinfo: Stack read overflow in no-aaaa mode
> +
> +If the system is configured in no-aaaa mode via /etc/resolv.conf,
> +getaddrinfo is called for the AF_UNSPEC address family, and a DNS
> +response is received over TCP that is larger than 2048 bytes,
> +getaddrinfo may potentially disclose stack contents via the returned
> +address data, or crash.

Should we add a little bit more information?  An initial paragraph like
this?

   This vulnerability affects the DNS client implementation in glibc.
   This component is responsible for translating DNS host names to
   addresses and back.  The vulnerability is in the NSS part of the DNS
   client.  Applications which call the getaddrinfo function are
   potentially impacted, but the older name resolution interfaces and
   the res_* family of functions are not affected.

And then as a third paragraph:

   The no-aaaa functionality was introduced in glibc 2.36.  Previous
   versions ignore the no-aaaa option if is present in /etc/resolv.conf.

And maybe even quote a vulnerable configuration snippet?

> +Public-date: 2023-09-12
> +Vulnerable-since: f282cdbe7f436c75864e5640a409a10485e9abb2
> +Fixed-by: bd77dd7e73e3530203be1c52c8a29d08270cb25d
> +Fixed-releases: 2.36, 2.37, 2.38, 2.39

CVE IDs should be repeated in the file itself.

It would be nice to note that f282cdbe7f436c75864e5640a409a10485e9abb2
is part of the 2.36 release.

> diff --git a/advisories/CVE-2023-5156 b/advisories/CVE-2023-5156
> new file mode 100644
> index 0000000000..5493453bec
> --- /dev/null
> +++ b/advisories/CVE-2023-5156
> @@ -0,0 +1,10 @@
> +getaddrinfo: DoS due to memory leak
> +
> +The fix for CVE-2023-4806 introduced a memory leak when an application
> +calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED
> +flags set.
> +
> +Public-date: 2023-09-25
> +Fixed-by: ec6b95c3303c700eb89eebeda2d7264cc184a796
> +Vulnerable-since: 973fe93a5675c42798b2161c6f29c01b0e243994
> +Fixed-releases: 2.34, 2.35, 2.36, 2.37, 2.38, 2.39
> diff --git a/scripts/process-fixed-cves.sh b/scripts/process-fixed-cves.sh
> new file mode 100755
> index 0000000000..d066b8c919

> +prevrel=$(git tag | grep "glibc-2.[0-9]\+$" |
> +	  sort -n -t. -k 1,2nr -k 2,3nr | head -1)

I think this is slightly more robust:

  git tag --sort=-taggerdate | grep '^glibc-2\.[0-9.]\+' | grep -v '\.9000$' 

Thanks,
Florian
  

Thanks, I'll update and post a v2.

On 2023-11-08 12:32, Florian Weimer wrote:
> * Siddhesh Poyarekar:
> 
>> One of the requirements to becoming a CVE Numbering Authority (CNA) is
>> to publish advisories.  Do this by maintaining a file for each CVE fixed
>> in the advisories directory in the source tree.  Links to the advisories
>> can then be shared as:
>>
>> https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/CVE-YYYY-NNNN
> 
> I think we should use our own identifiers (GLIBC-SA-2023-001 etc.)
> instead of CVE IDs.  CVE IDs can change due to duplicates, typos that
> lead to rejection etc., and I don't think Gitweb follows symbolic links
> in the repository (and we shouldn't check them in anyway because they
> are confusing).

OK, I can add glibc-specific IDs.

>> In future, backports up to glibc 2.39 should also include backport of
>> the relevant advisory file.
> 
> Should we replace the directory with a reference to the master branch
> upon branching for the release?  This way, the information is just in
> one place.

That'll make things easy, I agree.  This could be scripted on release.

>> diff --git a/advisories/CVE-2023-4527 b/advisories/CVE-2023-4527
>> new file mode 100644
>> index 0000000000..9bb4957501
>> --- /dev/null
>> +++ b/advisories/CVE-2023-4527
>> @@ -0,0 +1,12 @@
>> +getaddrinfo: Stack read overflow in no-aaaa mode
>> +
>> +If the system is configured in no-aaaa mode via /etc/resolv.conf,
>> +getaddrinfo is called for the AF_UNSPEC address family, and a DNS
>> +response is received over TCP that is larger than 2048 bytes,
>> +getaddrinfo may potentially disclose stack contents via the returned
>> +address data, or crash.
> 
> Should we add a little bit more information?  An initial paragraph like
> this?
> 
>     This vulnerability affects the DNS client implementation in glibc.
>     This component is responsible for translating DNS host names to
>     addresses and back.  The vulnerability is in the NSS part of the DNS
>     client.  Applications which call the getaddrinfo function are
>     potentially impacted, but the older name resolution interfaces and
>     the res_* family of functions are not affected.
> 
> And then as a third paragraph:
> 
>     The no-aaaa functionality was introduced in glibc 2.36.  Previous
>     versions ignore the no-aaaa option if is present in /etc/resolv.conf.
> 
> And maybe even quote a vulnerable configuration snippet?
> 

Sure, additional information would be great, would you be able to push a 
patch with more information for CVE-2023-4527 on top of the advisory 
file once I've committed this?  I'll do the other 3.

>> +Public-date: 2023-09-12
>> +Vulnerable-since: f282cdbe7f436c75864e5640a409a10485e9abb2
>> +Fixed-by: bd77dd7e73e3530203be1c52c8a29d08270cb25d
>> +Fixed-releases: 2.36, 2.37, 2.38, 2.39
> 
> CVE IDs should be repeated in the file itself.

Ack, and it will be necessary if the advisory files are of the form 
GLIBC-SA-YYYY-NNNN.

> 
> It would be nice to note that f282cdbe7f436c75864e5640a409a10485e9abb2
> is part of the 2.36 release.

Ack, I'll add a First-Vulnerable-release.

>> diff --git a/advisories/CVE-2023-5156 b/advisories/CVE-2023-5156
>> new file mode 100644
>> index 0000000000..5493453bec
>> --- /dev/null
>> +++ b/advisories/CVE-2023-5156
>> @@ -0,0 +1,10 @@
>> +getaddrinfo: DoS due to memory leak
>> +
>> +The fix for CVE-2023-4806 introduced a memory leak when an application
>> +calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED
>> +flags set.
>> +
>> +Public-date: 2023-09-25
>> +Fixed-by: ec6b95c3303c700eb89eebeda2d7264cc184a796
>> +Vulnerable-since: 973fe93a5675c42798b2161c6f29c01b0e243994
>> +Fixed-releases: 2.34, 2.35, 2.36, 2.37, 2.38, 2.39
>> diff --git a/scripts/process-fixed-cves.sh b/scripts/process-fixed-cves.sh
>> new file mode 100755
>> index 0000000000..d066b8c919
> 
>> +prevrel=$(git tag | grep "glibc-2.[0-9]\+$" |
>> +	  sort -n -t. -k 1,2nr -k 2,3nr | head -1)
> 
> I think this is slightly more robust:
> 
>    git tag --sort=-taggerdate | grep '^glibc-2\.[0-9.]\+' | grep -v '\.9000$'

Thanks, and how about this as the format for the auto-generated NEWS clip:

GLIBC-SA-YYYY-NNNN:
   CVE-YYYY-NNNN: One line description.

Thanks,
Sid