Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Patch protobuf CVE-2022-1941 #25490

Closed
wants to merge 2 commits into from
Closed

Patch protobuf CVE-2022-1941 #25490

wants to merge 2 commits into from

Conversation

msandstedt
Copy link
Contributor

Some tooling is using a version of protobuf with a known vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2022-1941

Change requirements to use the patched version.

Fixes #25489

@msandstedt msandstedt force-pushed the patch-CVE-2022-1941 branch from 0a43aa5 to 31a947d Compare March 6, 2023 15:31
@msandstedt
Copy link
Contributor Author

It looks like we need to update pigweed as well. PR for that is here: google/pigweed#12.

@github-actions
Copy link

github-actions bot commented Mar 6, 2023

PR #25490: Size comparison from 6dd5294 to b51076e

Full report (1 build for cc32xx)
platform target config section 6dd5294 b51076e change % change
cc32xx lock CC3235SF_LAUNCHXL 0 0 0 0.0
(read only) 643465 643465 0 0.0
(read/write) 203688 203688 0 0.0
.ARM.attributes 44 44 0 0.0
.ARM.exidx 8 8 0 0.0
.bss 197088 197088 0 0.0
.comment 194 194 0 0.0
.data 1480 1480 0 0.0
.debug_abbrev 930213 930213 0 0.0
.debug_aranges 87336 87336 0 0.0
.debug_frame 300024 300024 0 0.0
.debug_info 20262927 20262927 0 0.0
.debug_line 2657822 2657822 0 0.0
.debug_loc 2800026 2800026 0 0.0
.debug_ranges 282240 282240 0 0.0
.debug_str 3023883 3023883 0 0.0
.ramVecs 780 780 0 0.0
.resetVecs 64 64 0 0.0
.rodata 105929 105929 0 0.0
.shstrtab 232 232 0 0.0
.stab 204 204 0 0.0
.stabstr 441 441 0 0.0
.stack 2048 2048 0 0.0
.strtab 378514 378514 0 0.0
.symtab 256560 256560 0 0.0
.text 535412 535412 0 0.0

@msandstedt msandstedt force-pushed the patch-CVE-2022-1941 branch from b51076e to f8b6d47 Compare March 6, 2023 19:15
@github-actions
Copy link

github-actions bot commented Mar 6, 2023

PR #25490: Size comparison from d44b6a6 to f8b6d47

Decreases (1 build for cc32xx)
platform target config section d44b6a6 f8b6d47 change % change
cc32xx lock CC3235SF_LAUNCHXL .debug_info 20262928 20262927 -1 -0.0
Full report (3 builds for cc32xx, qpg)
platform target config section d44b6a6 f8b6d47 change % change
cc32xx lock CC3235SF_LAUNCHXL 0 0 0 0.0
(read only) 643465 643465 0 0.0
(read/write) 203688 203688 0 0.0
.ARM.attributes 44 44 0 0.0
.ARM.exidx 8 8 0 0.0
.bss 197088 197088 0 0.0
.comment 194 194 0 0.0
.data 1480 1480 0 0.0
.debug_abbrev 930213 930213 0 0.0
.debug_aranges 87336 87336 0 0.0
.debug_frame 300024 300024 0 0.0
.debug_info 20262928 20262927 -1 -0.0
.debug_line 2657822 2657822 0 0.0
.debug_loc 2800026 2800026 0 0.0
.debug_ranges 282240 282240 0 0.0
.debug_str 3023883 3023883 0 0.0
.ramVecs 780 780 0 0.0
.resetVecs 64 64 0 0.0
.rodata 105929 105929 0 0.0
.shstrtab 232 232 0 0.0
.stab 204 204 0 0.0
.stabstr 441 441 0 0.0
.stack 2048 2048 0 0.0
.strtab 378514 378514 0 0.0
.symtab 256560 256560 0 0.0
.text 535412 535412 0 0.0
qpg lighting-app qpg6105+debug (read/write) 1151820 1151820 0 0.0
.bss 99812 99812 0 0.0
.data 852 852 0 0.0
.text 598916 598916 0 0.0
lock-app qpg6105+debug (read/write) 1118868 1118868 0 0.0
.bss 96292 96292 0 0.0
.data 864 864 0 0.0
.text 565968 565968 0 0.0

@msandstedt msandstedt force-pushed the patch-CVE-2022-1941 branch from f8b6d47 to 6e3e914 Compare March 7, 2023 17:49
@msandstedt
Patch protobuf CVE-2022-1941
e1c7a45 
Some tooling is using a version of protobuf with a known vulnerability:
https://nvd.nist.gov/vuln/detail/CVE-2022-1941

Change requirements to use the patched version.

Fixes project-chip#25489
@msandstedt
update pigweed submodule to pull in protobuf version change
1d07436
@msandstedt msandstedt force-pushed the patch-CVE-2022-1941 branch from 6e3e914 to 1d07436 Compare March 7, 2023 17:51
@github-actions
Copy link

github-actions bot commented Mar 7, 2023

PR #25490: Size comparison from 4203370 to 1d07436

Full report (1 build for cc32xx)
platform target config section 4203370 1d07436 change % change
cc32xx lock CC3235SF_LAUNCHXL 0 0 0 0.0
(read only) 644425 644425 0 0.0
(read/write) 203688 203688 0 0.0
.ARM.attributes 44 44 0 0.0
.ARM.exidx 8 8 0 0.0
.bss 197088 197088 0 0.0
.comment 194 194 0 0.0
.data 1480 1480 0 0.0
.debug_abbrev 930235 930235 0 0.0
.debug_aranges 87336 87336 0 0.0
.debug_frame 300028 300028 0 0.0
.debug_info 2026706 2026706 0 0.0
.debug_line 2659698 2659698 0 0.0
.debug_loc 2802749 2802749 0 0.0
.debug_ranges 282952 282952 0 0.0
.debug_str 3023892 3023892 0 0.0
.ramVecs 780 780 0 0.0
.resetVecs 64 64 0 0.0
.rodata 105929 105929 0 0.0
.shstrtab 232 232 0 0.0
.stab 204 204 0 0.0
.stabstr 441 441 0 0.0
.stack 2048 2048 0 0.0
.strtab 378514 378514 0 0.0
.symtab 256624 256624 0 0.0
.text 536372 536372 0 0.0

@msandstedt
Copy link
Contributor Author

I succeeded in getting the protobuf patch upstreamed to https://pigweed.googlesource.com/pigweed/pigweed. However, pulling in the newest upstream pigweed now breaks a couple of our builds.

Do we have any resident pigweed experts?

@msandstedt msandstedt mentioned this pull request Mar 14, 2023
Closed
@andy31415
Copy link
Contributor

I succeeded in getting the protobuf patch upstreamed to https://pigweed.googlesource.com/pigweed/pigweed. However, pulling in the newest upstream pigweed now breaks a couple of our builds.

Do we have any resident pigweed experts?

#25351 is working towards that. https://pigweed.dev/docs/getting_started.html says there is a chatroom as well for direct asking. Wyatt is the owner for #25351

@stale
Copy link

stale bot commented May 20, 2023

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

@stale stale bot added the stale Stale issue or PR label May 20, 2023
@stale
Copy link

stale bot commented Jun 23, 2023

This stale pull request has been automatically closed. Thank you for your contributions.

@stale stale bot closed this Jun 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@amitnj amitnj Awaiting requested review from amitnj

@anush-apple anush-apple Awaiting requested review from anush-apple

@arkq arkq Awaiting requested review from arkq

@Byungjoo-Lee Byungjoo-Lee Awaiting requested review from Byungjoo-Lee

@carol-apple carol-apple Awaiting requested review from carol-apple

@chrisdecenzo chrisdecenzo Awaiting requested review from chrisdecenzo

@chshu chshu Awaiting requested review from chshu

@chulspro chulspro Awaiting requested review from chulspro

@cliffamzn cliffamzn Awaiting requested review from cliffamzn

@CodeChronos928 CodeChronos928 Awaiting requested review from CodeChronos928

@Damian-Nordic Damian-Nordic Awaiting requested review from Damian-Nordic

@dhrishi dhrishi Awaiting requested review from dhrishi

@electrocucaracha electrocucaracha Awaiting requested review from electrocucaracha

@franck-apple franck-apple Awaiting requested review from franck-apple

@gjc13 gjc13 Awaiting requested review from gjc13

@harsha-rajendran harsha-rajendran Awaiting requested review from harsha-rajendran

@hawk248 hawk248 Awaiting requested review from hawk248

@jelderton jelderton Awaiting requested review from jelderton

@jepenven-silabs jepenven-silabs Awaiting requested review from jepenven-silabs

@jmartinez-silabs jmartinez-silabs Awaiting requested review from jmartinez-silabs

@jtung-apple jtung-apple Awaiting requested review from jtung-apple

@kcoppock kcoppock Awaiting requested review from kcoppock

@kkasperczyk-no kkasperczyk-no Awaiting requested review from kkasperczyk-no

@ksperling-apple ksperling-apple Awaiting requested review from ksperling-apple

@lazarkov lazarkov Awaiting requested review from lazarkov

@lpbeliveau-silabs lpbeliveau-silabs Awaiting requested review from lpbeliveau-silabs

@LuDuda LuDuda Awaiting requested review from LuDuda

@mlepage-google mlepage-google Awaiting requested review from mlepage-google

@mspang mspang Awaiting requested review from mspang

@nivi-apple nivi-apple Awaiting requested review from nivi-apple

@pjzander-signify pjzander-signify Awaiting requested review from pjzander-signify

@saurabhst saurabhst Awaiting requested review from saurabhst

@selissia selissia Awaiting requested review from selissia

@sharadb-amazon sharadb-amazon Awaiting requested review from sharadb-amazon

@tcarmelveilleux tcarmelveilleux Awaiting requested review from tcarmelveilleux

@tecimovic tecimovic Awaiting requested review from tecimovic

@tehampson tehampson Awaiting requested review from tehampson

@turon turon Awaiting requested review from turon

@vijs vijs Awaiting requested review from vijs

@vivien-apple vivien-apple Awaiting requested review from vivien-apple

@woody-apple woody-apple Awaiting requested review from woody-apple

@xylophone21 xylophone21 Awaiting requested review from xylophone21

@yufengwangca yufengwangca Awaiting requested review from yufengwangca

@andy31415 andy31415 Awaiting requested review from andy31415

@bzbarsky-apple bzbarsky-apple Awaiting requested review from bzbarsky-apple

@jmeg-sfy jmeg-sfy Awaiting requested review from jmeg-sfy

@yunhanw-google yunhanw-google Awaiting requested review from yunhanw-google

@joonhaengHeo joonhaengHeo Awaiting requested review from joonhaengHeo

@younghak-hwang younghak-hwang Awaiting requested review from younghak-hwang

Assignees
No one assigned
Labels
review - approved scripts stale Stale issue or PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Patch protobuf CVE-2022-1941
5 participants
@msandstedt @andy31415 @yunhanw-google @bzbarsky-apple @jmeg-sfy