From d7fac4aa57a8c40391c6d06b2049253fd34dc177 Mon Sep 17 00:00:00 2001 From: Kevin Lockwood Date: Fri, 31 Jan 2025 09:20:34 -0800 Subject: [PATCH] Patch ceph for CVE-2012-2677 --- SPECS/ceph/CVE-2012-2677.patch | 105 +++++++++++++++++++++++++++++++++ SPECS/ceph/ceph.spec | 10 ++-- 2 files changed, 111 insertions(+), 4 deletions(-) create mode 100644 SPECS/ceph/CVE-2012-2677.patch diff --git a/SPECS/ceph/CVE-2012-2677.patch b/SPECS/ceph/CVE-2012-2677.patch new file mode 100644 index 00000000000..12d11816da7 --- /dev/null +++ b/SPECS/ceph/CVE-2012-2677.patch @@ -0,0 +1,105 @@ +Edited filepath to reflect the file tree within ceph + +Link: https://620468.bugs.gentoo.org/attachment.cgi?id=475060&action=diff&format=raw&headers=1 +--- a/src/boost/boost/pool/pool.hpp ++++ a/src/boost/boost/pool/pool.hpp +@@ -26,6 +26,8 @@ + + #include + ++// std::numeric_limits ++#include + // boost::integer::static_lcm + #include + // boost::simple_segregated_storage +@@ -355,6 +357,15 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t + return s; + } + ++ size_type max_chunks() const ++ { //! Calculated maximum number of memory chunks that can be allocated in a single call by this Pool. ++ size_type partition_size = alloc_size(); ++ size_type POD_size = integer::static_lcm::value + sizeof(size_type); ++ size_type max_chunks = (std::numeric_limits::max() - POD_size) / alloc_size(); ++ ++ return max_chunks; ++ } ++ + static void * & nextof(void * const ptr) + { //! \returns Pointer dereferenced. + //! (Provided and used for the sake of code readability :) +@@ -375,6 +386,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t + //! the first time that object needs to allocate system memory. + //! The default is 32. This parameter may not be 0. + //! \param nmax_size is the maximum number of chunks to allocate in one block. ++ set_next_size(nnext_size); ++ set_max_size(nmax_size); + } + + ~pool() +@@ -398,8 +411,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t + } + void set_next_size(const size_type nnext_size) + { //! Set number of chunks to request from the system the next time that object needs to allocate system memory. This value should never be set to 0. +- //! \returns nnext_size. +- next_size = start_size = nnext_size; ++ BOOST_USING_STD_MIN(); ++ next_size = start_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nnext_size, max_chunks()); + } + size_type get_max_size() const + { //! \returns max_size. +@@ -407,7 +420,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t + } + void set_max_size(const size_type nmax_size) + { //! Set max_size. +- max_size = nmax_size; ++ BOOST_USING_STD_MIN(); ++ max_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nmax_size, max_chunks()); + } + size_type get_requested_size() const + { //! \returns the requested size passed into the constructor. +@@ -708,9 +722,9 @@ void * pool::malloc_need_resize() + + BOOST_USING_STD_MIN(); + if(!max_size) +- next_size <<= 1; ++ set_next_size(next_size << 1); + else if( next_size*partition_size/requested_size < max_size) +- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); ++ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); + + // initialize it, + store().add_block(node.begin(), node.element_size(), partition_size); +@@ -748,9 +762,9 @@ void * pool::ordered_malloc_need_resize() + + BOOST_USING_STD_MIN(); + if(!max_size) +- next_size <<= 1; ++ set_next_size(next_size << 1); + else if( next_size*partition_size/requested_size < max_size) +- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); ++ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); + + // initialize it, + // (we can use "add_block" here because we know that +@@ -792,6 +806,8 @@ void * pool::ordered_malloc(const size_type n) + { //! Gets address of a chunk n, allocating new memory if not already available. + //! \returns Address of chunk n if allocated ok. + //! \returns 0 if not enough memory for n chunks. ++ if (n > max_chunks()) ++ return 0; + + const size_type partition_size = alloc_size(); + const size_type total_req_size = n * requested_size; +@@ -840,9 +856,9 @@ void * pool::ordered_malloc(const size_type n) + + BOOST_USING_STD_MIN(); + if(!max_size) +- next_size <<= 1; ++ set_next_size(next_size << 1); + else if( next_size*partition_size/requested_size < max_size) +- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); ++ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); + + // insert it into the list, + // handle border case. diff --git a/SPECS/ceph/ceph.spec b/SPECS/ceph/ceph.spec index 21eca3429e8..688c1a0b7a5 100644 --- a/SPECS/ceph/ceph.spec +++ b/SPECS/ceph/ceph.spec @@ -5,7 +5,7 @@ Summary: User space components of the Ceph file system Name: ceph Version: 18.2.2 -Release: 4%{?dist} +Release: 5%{?dist} License: LGPLv2 and LGPLv3 and CC-BY-SA and GPLv2 and Boost and BSD and MIT and Public Domain and GPLv3 and ASL-2.0 URL: https://ceph.io/ Vendor: Microsoft Corporation @@ -18,6 +18,7 @@ Patch3: CVE-2014-5461.patch Patch4: CVE-2020-22217.patch Patch5: CVE-2015-9251.patch Patch6: CVE-2012-6708.patch +Patch7: CVE-2012-2677.patch # # Copyright (C) 2004-2019 The Ceph Project Developers. See COPYING file # at the top-level directory of this distribution and at @@ -2005,16 +2006,17 @@ exit 0 %attr(0755,root,root) %dir %{_sysconfdir}/prometheus/ceph %config %{_sysconfdir}/prometheus/ceph/ceph_default_alerts.yml - - %changelog +* Thu Jan 30 2025 Kevin Lockwood - 18.2.2-5 +- Fix for CVE-2012-2677 + * Tue Jan 28 2025 Kevin Lockwood - 18.2.2-4 - Fix for CVE-2014-5461 - Fix for CVE-2020-22217 - Fix for CVE-2015-9251 - Fix for CVE-2012-6708 -* Tue Jan 01 2025 Sandeep Karambelkar - 18.2.2-3 +* Wed Jan 01 2025 Sandeep Karambelkar - 18.2.2-3 - Based on the package build logs, opentelemetry-cpp submodule is not being built - Removing opentelemetry-cpp to address below CVEs as this submodule is not relevant - CVE-2022-24735