[oss-security] Attempting to patch ghostscript-9.25

[Ken Moffat]

Hi,

I hope people can read this - I know that google marks my mails as
spam (so no point Cc'ing Tavis) and also that Suse discard my mails.
Probably many other places also do that. Anyway:

When the first set of vulnerabilities in 9.25 came out there was a
nice 'mostly harmless' example, and I patched BLFS for that (needed
one extra commit beyond the two Tavis specified, so that I could
make sense of where to apply part of it).

For the later vulnerabilities, working out what to apply has been
much harder. Either everyone else thinks that other mitigations
against untrusted ps files will suffice, or else it's on everybody's
ToDo lists.

So, here is a first attempt to fix all this month's vulnerabilities.
For the latest exploit(s) I do not have an example, so I don't know
whether or not this works. But it prevents the earlier
vulnerability, and usage of real ps (and eps - I only have the gs
examples, and only gs seems able to use them) seems to work
correctly. Unlike my first attempt to fix this, which turned out
to fail to display any ps, eps files.

The patch is a bit big, so I've uploaded it to
http://www.linuxfromscratch.org/~ken/provisional/ as
ghostscript-9.25-security_fixes-2.patch

'provisional' until I find out if it protects adequately. If there
turn out ot be problems, I suppose I'll need to renumber later
versions.

Built in BLFS using the same instructions as for the earlier -1
patch [ http://www.linuxfromscratch.org/blfs/view/svn/pst/gs.html ]
but that doesn't mean it will work for everyone else's ways of
building. Note tht I _do_ build the shared library.

The patch lists which upstream commits I pulled in. I was mostly
concentrating on changes to gs_init which would maybe help me apply
the needed patches. As I've noted in the patch's introduction,
several commits had negative offsets (I guess hunks of code were
removed in some of the unrelated commits that I ignored).

Comments welcome.

One final thought - apart from 9.25, upstream seem to have an
approximately 6-monthly release schedule, so probably the only thing
likely to speed up 9.26 is everybody patching ;)

ĸen

[Jordan Glover]

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

Post by Ken Moffat
Hi,
I hope people can read this - I know that google marks my mails as
spam (so no point Cc'ing Tavis) and also that Suse discard my mails.
When the first set of vulnerabilities in 9.25 came out there was a
nice 'mostly harmless' example, and I patched BLFS for that (needed
one extra commit beyond the two Tavis specified, so that I could
make sense of where to apply part of it).
For the later vulnerabilities, working out what to apply has been
much harder. Either everyone else thinks that other mitigations
against untrusted ps files will suffice, or else it's on everybody's
ToDo lists.
So, here is a first attempt to fix all this month's vulnerabilities.
For the latest exploit(s) I do not have an example, so I don't know
whether or not this works. But it prevents the earlier
vulnerability, and usage of real ps (and eps - I only have the gs
examples, and only gs seems able to use them) seems to work
correctly. Unlike my first attempt to fix this, which turned out
to fail to display any ps, eps files.
The patch is a bit big, so I've uploaded it to
http://www.linuxfromscratch.org/~ken/provisional/ as
ghostscript-9.25-security_fixes-2.patch
'provisional' until I find out if it protects adequately. If there
turn out ot be problems, I suppose I'll need to renumber later
versions.
Built in BLFS using the same instructions as for the earlier -1
patch [ http://www.linuxfromscratch.org/blfs/view/svn/pst/gs.html ]
but that doesn't mean it will work for everyone else's ways of
building. Note tht I do build the shared library.
The patch lists which upstream commits I pulled in. I was mostly
concentrating on changes to gs_init which would maybe help me apply
the needed patches. As I've noted in the patch's introduction,
several commits had negative offsets (I guess hunks of code were
removed in some of the unrelated commits that I ignored).
Comments welcome.
One final thought - apart from 9.25, upstream seem to have an
approximately 6-monthly release schedule, so probably the only thing
likely to speed up 9.26 is everybody patching ;)
ĸen

I think the easiest way is to build on upstream git snapshot.
All of its contents will be included in future release anyway.

Jordan

[Ken Moffat]

Post by Jordan Glover
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

Post by Ken Moffat
The patch is a bit big, so I've uploaded it to
http://www.linuxfromscratch.org/~ken/provisional/ as
ghostscript-9.25-security_fixes-2.patch
'provisional' until I find out if it protects adequately. If there
turn out ot be problems, I suppose I'll need to renumber later
versions.

I've now been given an exploit, in a PDF (I was not subscribed here
until Friday, missed some of the earleir stuff). That -2 patch fixes
it.

Tested with evince (which now loops trying to rended an empty page,
same as with the .ps exploit), so I've committed it in BLFS. Will
take down the 'provisional' copy in a few days.

Post by Jordan Glover
I think the easiest way is to build on upstream git snapshot.
All of its contents will be included in future release anyway.
Jordan

If upstream are like anywhere else, some changes get backed out or
modified so they might not be there when 9.26 is released. OTOH,
one of the changes I ignored might stop evince looping on a
'damaged' PDF. Swings and roundabouts.

ĸen