Repository: spack/spack

Issue:
Backport Security fixes for CVE-2024-27322 into R 4.3.3 or other R versions
### Summary

Hello, on 2024-04-29 Posit and NIST made the following announcement about this R vulnerability that allows for rdb files to run exploits when an malicious rdb or even a malicious CRAN package is installed. That affects all R versions from 1.4.0 to 4.3.3.

https://nvd.nist.gov/vuln/detail/CVE-2024-27322

https://support.posit.co/hc/en-us/articles/23170092899607-CVE-2024-27322-R-bitrary-Code-Execution

### Rationale

Unfortunately, R did not publicly release a backported security fix to fix this in R 4.3 or any older version and Posit does not provide any solution other than "Update to 4.4.0", 

Obviously converting my code from R 4.3.0 to R 4.4 rapidly within a matter of days is not really palatable to me or anyone, let alone people who are stuck on R 3.6.

### Description

So I decided to look at Fedora Project which is known for backporting security fixes rather than upgrading to newer versions, and it looks like. It looks like the Fedora Project either found or contributed a security patch to the R SVN that replicates the solution to the problem in R 4.4, and backported it into their R 4.3.3 rpm using the following patch.

https://src.fedoraproject.org/rpms/R/blob/f39/R-CVE-2024-27322.patch

https://src.fedoraproject.org/rpms/R/tree/f39

https://koji.fedoraproject.org/koji/buildinfo?buildID=2446431

https://bugzilla.redhat.com/show_bug.cgi?id=2277884

This patch also seems to be in the official R SVN as of 2024-05-01, but I just wanted to let the public know about it in case R takes a long time to back port it to older versions. 

https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7

It may very well be that this patch didn't pass some sort of important testing for the R developers but if this situation goes on it may be best to follow Fedora Project to patch 4.3.3. 

I'll test out this patch with 4.3.3 on my own spack installation and reply with findings, other people might find it useful to try to test it out on past R versions as well.

### Additional information

This is related to the next SPACK issue I will open asking about build errors in R 4.4.0, of which introducing that version to replace past R versions is the official recommendation from Posit and NIST.

### General information

- [X] I have searched the issues of this repo and believe this is not a duplicate


Discussion:
I managed to test this patch to work on spack v0.20.3 not only with R 4.3.3 (which is not yet in v0.21.2 or the develop branch, only 4.3.2 is in the develop branch, do add that), but the following versions as well:

(Note that R versions older than 4.2 require curl 7, which is deprecated due to severe CVEs in SPACK. If you are using Ubuntu or Rocky/Alma Linux, you must use your distribution's version of curl 7 to build these by running `spack external find --scope site curl`)

* 4.2.3
* 4.1.3
* 4.0.5
* 3.6.3

(I haven't tested below R 3.6.3.)

After checking the git blame for R [prior to the commit that fixes this bug](https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7), I determined that **it can be assumed that all R versions introduced after Dec 28, 2017 can have this CVE patch applied.**

https://github.com/r-devel/r-svn/blame/e1e7acbda041b32f111962c28b4cdfe5f81efc30/src/main/serialize.c#L2702

However, given that R developers did not backport this change to older R versions than 4.4, we have to wonder why they decided against it. 

**Perhaps as this blog post demonstrates, R 4.4.0 and this CVE patch didn't truly fix the serialization vulnerability, since a real fix might mean eliminating serialization from R data files altogether: therefore watch out for more CVE patches or backports from Fedora.**

https://securityboulevard.com/2024/05/cve-2024-27322-should-never-have-been-assigned-and-r-data-files-are-still-super-risky-even-in-r-4-4-0/

## Applying the CVE Patch in SPACK

I added this patch in this file as follows after putting the [R-CVE-2024-27322.patch](https://src.fedoraproject.org/rpms/R/blob/f39/R-CVE-2024-27322.patch) file in `var/spack/repos/builtin/packages/r/` : https://github.com/spack/spack/blob/develop/var/spack/repos/builtin/packages/r/package.py . Since the patch is not needed for 4.4.0, I think this when= definition will apply it only to 4.3.3 and below.

```
# CVE-2024-27322 Patch only needed in R 4.3.3 and below, unless R backports to versions under R 4.4.0 later
# https://src.fedoraproject.org/rpms/R/blob/f39/R-CVE-2024-27322.patch
# https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7
patch("R-CVE-2024-27322.patch", when="@:4.3.3")
```

## R versions older than 4.3 don't build in SPACK v0.21.2

The reason I had to use v0.21.2 to test older R builds is because due to this? https://github.com/spack/spack/pull/40442 I keep getting the configure error, because it detect:

```
checking libcurl version ... 8.4.0
configure: error: libcurl >= 7.28.0 library and headers are required with support for https
```

Even though I already set up  `spack external find --scope site curl` and did to use Rocky/Alma Linux 8's curl 7.61.1. The spack spec concretizer in fact says that it would install ^curl@7.61.1 . So this makes it impossible to install older R versions on the latest develop or v0.21.2 tag, I have to revert to v0.20.3 for it to work.,

## R doesn't make install properly in v0.21.2 

Another relevant note is that the v0.21.2 tag fails to build any R versions at the make install stage for me where v0.20 works properly, which is probably solved by this commit in develop branch regarding the which command: Please cherry pick that into v0.21.

https://github.com/spack/spack/commit/bc9b39cb73a83219306e67191b560412155200d5

## R 4.4.0 added to the Develop Branch

Also, I see that R 4.4.0 was added to the develop branch, which compiles great. Before this, when I tried building R in v0.21.2 in Alma Linux 8, when external-lapack is set it keeps failing to load lapack, but the develop branch fixes it. Please import that commit into v0.21.

https://github.com/spack/spack/commit/18ebef60aab93728e26d9aa5d18450f1d6c7bbd1

https://github.com/spack/spack/blob/develop/var/spack/repos/builtin/packages/r/package.py

Resolving patch:
diff --git a/var/spack/repos/builtin/packages/r/package.py b/var/spack/repos/builtin/packages/r/package.py
--- a/var/spack/repos/builtin/packages/r/package.py
+++ b/var/spack/repos/builtin/packages/r/package.py
@@ -23,6 +23,7 @@ class R(AutotoolsPackage):
     license("GPL-2.0-or-later")
 
     version("4.4.0", sha256="ace4125f9b976d2c53bcc5fca30c75e30d4edc401584859cbadb080e72b5f030")
+    version("4.3.3", sha256="80851231393b85bf3877ee9e39b282e750ed864c5ec60cbd68e6e139f0520330")
     version("4.3.2", sha256="b3f5760ac2eee8026a3f0eefcb25b47723d978038eee8e844762094c860c452a")
     version("4.3.1", sha256="8dd0bf24f1023c6f618c3b317383d291b4a494f40d73b983ac22ffea99e4ba99")
     version("4.3.0", sha256="45dcc48b6cf27d361020f77fde1a39209e997b81402b3663ca1c010056a6a609")
@@ -113,6 +114,13 @@ class R(AutotoolsPackage):
     # gets stored as compressed byte code, which is not relocatable
     patch("relocate-which.patch")
 
+    # CVE-2024-27322 Patch only needed in R 4.3.3 and below; doesn't apply to R older than 3.5.0.
+    patch(
+        "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch?full_index=1",
+        sha256="56c77763cb104aa9cb63420e585da63cb2c23bc03fa3ef9d088044eeff9d7380",
+        when="@3.5.0:4.3.3",
+    )
+
     build_directory = "spack-build"
 
     # R custom URL version


Test patch: