From 6ad1c2bc842a008bdedd55f2039577951dabc5fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= Date: Sat, 16 Dec 2023 10:46:33 +0700 Subject: [PATCH] bluez: patch for CVE-2023-45866 bluez-5.71 crashed on i686 --- srcpkgs/bluez/patches/CVE-2023-45866.patch | 52 ++++++++++++++++++++++ srcpkgs/bluez/template | 7 ++- 2 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/bluez/patches/CVE-2023-45866.patch diff --git a/srcpkgs/bluez/patches/CVE-2023-45866.patch b/srcpkgs/bluez/patches/CVE-2023-45866.patch new file mode 100644 index 00000000000..7d3be48eeb6 --- /dev/null +++ b/srcpkgs/bluez/patches/CVE-2023-45866.patch @@ -0,0 +1,52 @@ +From 25a471a83e02e1effb15d5a488b3f0085eaeb675 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 10 Oct 2023 13:03:12 -0700 +Subject: input.conf: Change default of ClassicBondedOnly + +This changes the default of ClassicBondedOnly since defaulting to false +is not inline with HID specification which mandates the of Security Mode +4: + +BLUETOOTH SPECIFICATION Page 84 of 123 +Human Interface Device (HID) Profile: + + 5.4.3.4.2 Security Modes + Bluetooth HID Hosts shall use Security Mode 4 when interoperating with + Bluetooth HID devices that are compliant to the Bluetooth Core + Specification v2.1+EDR[6]. +--- + profiles/input/device.c | 2 +- + profiles/input/input.conf | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +(limited to 'profiles/input') + +diff --git a/profiles/input/device.c b/profiles/input/device.c +index 4a50ea9921..4310dd192e 100644 +--- a/profiles/input/device.c ++++ b/profiles/input/device.c +@@ -81,7 +81,7 @@ struct input_device { + + static int idle_timeout = 0; + static bool uhid_enabled = false; +-static bool classic_bonded_only = false; ++static bool classic_bonded_only = true; + + void input_set_idle_timeout(int timeout) + { +diff --git a/profiles/input/input.conf b/profiles/input/input.conf +index 4c70bc561f..d8645f3dd6 100644 +--- a/profiles/input/input.conf ++++ b/profiles/input/input.conf +@@ -17,7 +17,7 @@ + # platforms may want to make sure that input connections only come from bonded + # device connections. Several older mice have been known for not supporting + # pairing/encryption. +-# Defaults to false to maximize device compatibility. ++# Defaults to true for security. + #ClassicBondedOnly=true + + # LE upgrade security +-- +cgit 1.2.3-korg + diff --git a/srcpkgs/bluez/template b/srcpkgs/bluez/template index 8bb8bed0d26..0145a629c69 100644 --- a/srcpkgs/bluez/template +++ b/srcpkgs/bluez/template @@ -1,7 +1,7 @@ # Template file for 'bluez' pkgname=bluez version=5.70 -revision=1 +revision=2 build_style=gnu-configure configure_args="--with-udevdir=/usr/lib/udev --disable-systemd --enable-sixaxis --enable-threads --enable-library --enable-deprecated @@ -21,6 +21,7 @@ conf_files="/etc/bluetooth/main.conf" system_groups="bluetooth" build_options="mesh nfc experimental" +build_options_default="mesh nfc" if [ "$XBPS_TARGET_LIBC" = musl ]; then makedepends+=" musl-legacy-compat" @@ -37,12 +38,16 @@ pre_configure() { post_install() { vinstall ${wrksrc}/src/main.conf 644 etc/bluetooth + vinstall profiles/input/input.conf 644 etc/bluetooth + vinstall profiles/network/network.conf 644 etc/bluetooth vbin attrib/gatttool vbin tools/btgatt-client vbin tools/btgatt-server vsv bluetoothd if [ "$build_option_mesh" ]; then vsv bluetooth-meshd + vinstall mesh/bluetooth-mesh.conf 644 etc/bluetooth + vinstall mesh/mesh-main.conf 644 etc/bluetooth fi vdoc ${FILESDIR}/README.voidlinux