mirror of
https://github.com/flatcar/scripts.git
synced 2025-11-03 09:41:22 +01:00
70e0da0687
Apply existing Flatcar changes on top of vanilla Gentoo ebuilds: - add arm64 keyword - apply the sais patch - fix a heap overflow vulnerability in bspatch included in bsdiff. Originally the security issue was published as [FreeBSD-SA-16:29](https://www.freebsd.org/security/advisories/FreeBSD-SA-16:29.bspatch.asc), which pointed to a FreeBSD [patch](https://security.freebsd.org/patches/SA-16:29/bspatch.patch). However, the patch was a set of huge changes including other unrelated changes. That's why it was not simple at all to apply the patch to bsdiff. Both Gentoo and Flatcar have not included the fix. Fortunately X41 D-SEC [examined](https://www.x41-dsec.de/security/news/working/research/2020/07/15/bspatch/) the issue again, and nailed down to a simple patch that can be easily applied to other trees. We simply take the patch with minimal changes. See also [CVE-2020-14315](https://nvd.nist.gov/vuln/detail/CVE-2020-14315). It is based on the following commits: [4ee6aa895a02](https://github.com/kinvolk/coreos-overlay/commit/4ee6aa895a02) ("Add arm64 keywords") [60d47e7359d1](https://github.com/kinvolk/coreos-overlay/commit/60d47e7359d1) ("Change suffix sort to sais-lite") [7d3ac2a049dd](https://github.com/kinvolk/coreos-overlay/commit/7d3ac2a049dd) ("fix heap overflow vulnerability CVE-2020-14315")