Thomas Perale
e197babd38
Fixes the following vulnerabilities:
- CVE-2024-50382:
Botan before 3.6.0, when certain LLVM versions are used, has compiler-
induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in
GHASH in AES-GCM. There is a branch instead of an XOR with carry. This
was observed for Clang in LLVM 15 on RISC-V.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-50382
- https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957
- CVE-2024-50383:
Botan before 3.6.0, when certain GCC versions are used, has a
compiler-induced secret-dependent operation in lib/utils/donna128.h in
donna128 (used in Chacha-Poly1305 and x25519). An addition can be
skipped if a carry is not set. This was observed for GCC 11.3.0 with
-O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be
affected.)
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-50383
- https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
123 lines
2.8 KiB
Makefile
123 lines
2.8 KiB
Makefile
################################################################################
|
|
#
|
|
# botan
|
|
#
|
|
################################################################################
|
|
|
|
BOTAN_VERSION = 3.5.0
|
|
BOTAN_SOURCE = Botan-$(BOTAN_VERSION).tar.xz
|
|
BOTAN_SITE = http://botan.randombit.net/releases
|
|
BOTAN_LICENSE = BSD-2-Clause
|
|
BOTAN_LICENSE_FILES = license.txt
|
|
BOTAN_CPE_ID_VALID = YES
|
|
|
|
# 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
|
|
BOTAN_IGNORE_CVES += CVE-2024-50382 CVE-2024-50383
|
|
|
|
BOTAN_INSTALL_STAGING = YES
|
|
|
|
BOTAN_DEPENDENCIES = host-python3
|
|
BOTAN_CONF_OPTS = \
|
|
--cpu=$(BR2_ARCH) \
|
|
--disable-cc-tests \
|
|
--os=linux \
|
|
--cc=gcc \
|
|
--cc-bin="$(TARGET_CXX)" \
|
|
--prefix=/usr \
|
|
--without-documentation
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
|
|
BOTAN_CONF_OPTS += --extra-libs=atomic
|
|
endif
|
|
|
|
ifeq ($(BR2_SHARED_LIBS),y)
|
|
BOTAN_CONF_OPTS += \
|
|
--disable-static-library \
|
|
--enable-shared-library
|
|
else ifeq ($(BR2_STATIC_LIBS),y)
|
|
BOTAN_CONF_OPTS += \
|
|
--disable-shared-library \
|
|
--enable-static-library \
|
|
--no-autoload
|
|
else ifeq ($(BR2_SHARED_STATIC_LIBS),y)
|
|
BOTAN_CONF_OPTS += \
|
|
--enable-shared-library \
|
|
--enable-static-library
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
|
|
BOTAN_CONF_OPTS += --with-stack-protector
|
|
else
|
|
BOTAN_CONF_OPTS += --without-stack-protector
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS_NPTL),y)
|
|
BOTAN_CONF_OPTS += --with-os-feature=threads
|
|
else
|
|
BOTAN_CONF_OPTS += --without-os-feature=threads
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_USES_UCLIBC),y)
|
|
BOTAN_CONF_OPTS += --without-os-feature=explicit_bzero,getauxval,getentropy
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_BOOST_FILESYSTEM)$(BR2_PACKAGE_BOOST_SYSTEM),yy)
|
|
BOTAN_DEPENDENCIES += boost
|
|
BOTAN_CONF_OPTS += --with-boost
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_BZIP2),y)
|
|
BOTAN_DEPENDENCIES += bzip2
|
|
BOTAN_CONF_OPTS += --with-bzip2
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_SQLITE),y)
|
|
BOTAN_DEPENDENCIES += sqlite
|
|
BOTAN_CONF_OPTS += --with-sqlite
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_TROUSERS),y)
|
|
BOTAN_DEPENDENCIES += trousers
|
|
BOTAN_CONF_OPTS += --with-tpm
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XZ),y)
|
|
BOTAN_DEPENDENCIES += xz
|
|
BOTAN_CONF_OPTS += --with-lzma
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
BOTAN_DEPENDENCIES += zlib
|
|
BOTAN_CONF_OPTS += --with-zlib
|
|
endif
|
|
|
|
ifeq ($(BR2_POWERPC_CPU_HAS_ALTIVEC),)
|
|
BOTAN_CONF_OPTS += --disable-altivec
|
|
endif
|
|
|
|
ifeq ($(BR2_ARM_CPU_HAS_NEON),)
|
|
BOTAN_CONF_OPTS += --disable-neon
|
|
endif
|
|
|
|
ifeq ($(BR2_SOFT_FLOAT),y)
|
|
BOTAN_CONF_OPTS += --disable-neon
|
|
endif
|
|
|
|
define BOTAN_CONFIGURE_CMDS
|
|
(cd $(@D); $(TARGET_MAKE_ENV) ./configure.py $(BOTAN_CONF_OPTS))
|
|
endef
|
|
|
|
define BOTAN_BUILD_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) AR="$(TARGET_AR)"
|
|
endef
|
|
|
|
define BOTAN_INSTALL_STAGING_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR="$(STAGING_DIR)" install
|
|
endef
|
|
|
|
define BOTAN_INSTALL_TARGET_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR="$(TARGET_DIR)" install
|
|
endef
|
|
|
|
$(eval $(generic-package))
|