Patched `systemd` to fix CVE-2022-3821 (#4256)

* Add patch for CVE-2022-3821

* Add patch to systemd-bootstrap.spec to mirror changes to systemd.spec

* update systemd-bootstrap version in manifests

SPECS/systemd/CVE-2022-3821.patch

@@ -0,0 +1,40 @@
+From 9102c625a673a3246d7e73d8737f3494446bad4e Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Thu, 7 Jul 2022 18:27:02 +0900
+Subject: [PATCH] time-util: fix buffer-over-run
+
+Fixes #23928.
+---
+ src/basic/time-util.c     | 2 +-
+ src/test/test-time-util.c | 5 +++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index abbc4ad5cd70..26d59de12348 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -591,7 +591,7 @@ char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy) {
+                         t = b;
+                 }
+ 
+-                n = MIN((size_t) k, l);
++                n = MIN((size_t) k, l-1);
+ 
+                 l -= n;
+                 p += n;
+diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c
+index e8e4e2a67bb1..58c5fa9be40c 100644
+--- a/src/test/test-time-util.c
++++ b/src/test/test-time-util.c
+@@ -238,6 +238,11 @@ TEST(format_timespan) {
+         test_format_timespan_accuracy(1);
+         test_format_timespan_accuracy(USEC_PER_MSEC);
+         test_format_timespan_accuracy(USEC_PER_SEC);
++
++        /* See issue #23928. */
++        _cleanup_free_ char *buf;
++        assert_se(buf = new(char, 5));
++        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
+ }
+ 
+ TEST(verify_timezone) {

SPECS/systemd/systemd-bootstrap.spec

@@ -1,7 +1,7 @@
 Summary:        Bootstrap version of systemd. Workaround for systemd circular dependency.
 Name:           systemd-bootstrap
 Version:        250.3
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        LGPLv2+ AND GPLv2+ AND MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -18,6 +18,8 @@ Patch1:         add-fsync-sysusers-passwd.patch
 # Patch2 can be removed once we update systemd to a version containing the following commit:
 # https://github.com/systemd/systemd/commit/d5cb053cd93d516f516e0b748271b55f9dfb3a29
 Patch2:         gpt-auto-devno-not-determined.patch
+# Patch3 can be removed once we update to major version 251 or higher:
+Patch3:         CVE-2022-3821.patch
 BuildRequires:  docbook-dtd-xml
 BuildRequires:  docbook-style-xsl
 BuildRequires:  gettext
@@ -231,6 +233,9 @@ systemctl preset-all
 %{_datadir}/pkgconfig/udev.pc
 
 %changelog
+* Fri Nov 18 2022 Sam Meluch <sammeluch@microsoft.com> - 250.3-8
+- Add patch for CVE-2022-3821
+
 * Tue Oct 04 2022 Pawel Winogrodzki <pawelwi@microsoft.com> - 250.3-7
 - Fixing default log location.
 

SPECS/systemd/systemd.spec

@@ -1,7 +1,7 @@
 Summary:        Systemd-250
 Name:           systemd
 Version:        250.3
-Release:        9%{?dist}
+Release:        10%{?dist}
 License:        LGPLv2+ AND GPLv2+ AND MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -18,6 +18,8 @@ Patch1:         add-fsync-sysusers-passwd.patch
 # Patch2 can be removed once we update systemd to a version containing the following commit:
 # https://github.com/systemd/systemd/commit/d5cb053cd93d516f516e0b748271b55f9dfb3a29
 Patch2:         gpt-auto-devno-not-determined.patch
+# Patch3 can be removed once we update to major version 251 or higher:
+Patch3:         CVE-2022-3821.patch
 BuildRequires:  cryptsetup-devel
 BuildRequires:  docbook-dtd-xml
 BuildRequires:  docbook-style-xsl
@@ -261,6 +263,9 @@ systemctl preset-all
 %files lang -f %{name}.lang
 
 %changelog
+* Thu Nov 17 2022 Sam Meluch <sammeluch@microsoft.com> - 250.3-10
+- Add patch for CVE-2022-3821
+
 * Tue Oct 04 2022 Pawel Winogrodzki <pawelwi@microsoft.com> - 250.3-9
 - Fixing default log location.
 

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -545,10 +545,10 @@ sqlite-devel-3.39.2-1.cm2.aarch64.rpm
 sqlite-libs-3.39.2-1.cm2.aarch64.rpm
 swig-4.0.2-3.cm2.aarch64.rpm
 swig-debuginfo-4.0.2-3.cm2.aarch64.rpm
-systemd-bootstrap-250.3-7.cm2.aarch64.rpm
-systemd-bootstrap-debuginfo-250.3-7.cm2.aarch64.rpm
-systemd-bootstrap-devel-250.3-7.cm2.aarch64.rpm
-systemd-bootstrap-rpm-macros-250.3-7.cm2.noarch.rpm
+systemd-bootstrap-250.3-8.cm2.aarch64.rpm
+systemd-bootstrap-debuginfo-250.3-8.cm2.aarch64.rpm
+systemd-bootstrap-devel-250.3-8.cm2.aarch64.rpm
+systemd-bootstrap-rpm-macros-250.3-8.cm2.noarch.rpm
 tar-1.34-1.cm2.aarch64.rpm
 tar-debuginfo-1.34-1.cm2.aarch64.rpm
 tdnf-3.2.2-4.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -545,10 +545,10 @@ sqlite-devel-3.39.2-1.cm2.x86_64.rpm
 sqlite-libs-3.39.2-1.cm2.x86_64.rpm
 swig-4.0.2-3.cm2.x86_64.rpm
 swig-debuginfo-4.0.2-3.cm2.x86_64.rpm
-systemd-bootstrap-250.3-7.cm2.x86_64.rpm
-systemd-bootstrap-debuginfo-250.3-7.cm2.x86_64.rpm
-systemd-bootstrap-devel-250.3-7.cm2.x86_64.rpm
-systemd-bootstrap-rpm-macros-250.3-7.cm2.noarch.rpm
+systemd-bootstrap-250.3-8.cm2.x86_64.rpm
+systemd-bootstrap-debuginfo-250.3-8.cm2.x86_64.rpm
+systemd-bootstrap-devel-250.3-8.cm2.x86_64.rpm
+systemd-bootstrap-rpm-macros-250.3-8.cm2.noarch.rpm
 tar-1.34-1.cm2.x86_64.rpm
 tar-debuginfo-1.34-1.cm2.x86_64.rpm
 tdnf-3.2.2-4.cm2.x86_64.rpm