summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSona Sarmadi <sona.sarmadi@enea.com>2016-11-30 13:17:39 +0100
committerOtavio Salvador <otavio@ossystems.com.br>2016-12-09 09:41:45 -0200
commitc81b13fce917cfa8a0bb98da18817dcc14ac6b11 (patch)
tree5db1efe28a2fceb589c36756ac5df5d004377f22
parenta870befa7789197b0091cc18c9c5196a848a75c7 (diff)
downloadmeta-freescale-c81b13fce917cfa8a0bb98da18817dcc14ac6b11.tar.gz
linux-qoriq: fix CVE-2016-0758
Fixes a flaw in the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privileges on the system. References: https://lkml.org/lkml/2016/5/12/270 Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/ ?id=af00ae6ef5a2c73f21ba215c476570b7772a14fb [backported from stable 3.16] Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
-rw-r--r--recipes-kernel/linux/linux-qoriq/CVE-2016-0758.patch98
-rw-r--r--recipes-kernel/linux/linux-qoriq_4.1.bb1
2 files changed, 99 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-qoriq/CVE-2016-0758.patch b/recipes-kernel/linux/linux-qoriq/CVE-2016-0758.patch
new file mode 100644
index 00000000..5447552f
--- /dev/null
+++ b/recipes-kernel/linux/linux-qoriq/CVE-2016-0758.patch
@@ -0,0 +1,98 @@
1From af00ae6ef5a2c73f21ba215c476570b7772a14fb Mon Sep 17 00:00:00 2001
2From: David Howells <dhowells@redhat.com>
3Date: Tue, 23 Feb 2016 11:03:12 +0000
4Subject: KEYS: Fix ASN.1 indefinite length object parsing
5
6commit 23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa upstream.
7
8This fixes CVE-2016-0758.
9
10In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
11it isn't validated against the remaining amount of data before being added
12to the cursor. With a sufficiently large size indicated, the check:
13
14 datalen - dp < 2
15
16may then fail due to integer overflow.
17
18Fix this by checking the length indicated against the amount of remaining
19data in both places a definite length is determined.
20
21Whilst we're at it, make the following changes:
22
23 (1) Check the maximum size of extended length does not exceed the capacity
24 of the variable it's being stored in (len) rather than the type that
25 variable is assumed to be (size_t).
26
27 (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
28 integer 0.
29
30 (3) To reduce confusion, move the initialisation of len outside of:
31
32 for (len = 0; n > 0; n--) {
33
34 since it doesn't have anything to do with the loop counter n.
35
36CVE: CVE-2016-0758.
37Upstream-Status: Backport [backported from kernel.org 3.16 branch]
38
39Signed-off-by: David Howells <dhowells@redhat.com>
40Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
41Acked-by: David Woodhouse <David.Woodhouse@intel.com>
42Acked-by: Peter Jones <pjones@redhat.com>
43Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
44Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
45---
46 lib/asn1_decoder.c | 16 +++++++++-------
47 1 file changed, 9 insertions(+), 7 deletions(-)
48
49diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
50index d60ce8a..806c5b6 100644
51--- a/lib/asn1_decoder.c
52+++ b/lib/asn1_decoder.c
53@@ -69,7 +69,7 @@ next_tag:
54
55 /* Extract a tag from the data */
56 tag = data[dp++];
57- if (tag == 0) {
58+ if (tag == ASN1_EOC) {
59 /* It appears to be an EOC. */
60 if (data[dp++] != 0)
61 goto invalid_eoc;
62@@ -91,10 +91,8 @@ next_tag:
63
64 /* Extract the length */
65 len = data[dp++];
66- if (len <= 0x7f) {
67- dp += len;
68- goto next_tag;
69- }
70+ if (len <= 0x7f)
71+ goto check_length;
72
73 if (unlikely(len == ASN1_INDEFINITE_LENGTH)) {
74 /* Indefinite length */
75@@ -105,14 +103,18 @@ next_tag:
76 }
77
78 n = len - 0x80;
79- if (unlikely(n > sizeof(size_t) - 1))
80+ if (unlikely(n > sizeof(len) - 1))
81 goto length_too_long;
82 if (unlikely(n > datalen - dp))
83 goto data_overrun_error;
84- for (len = 0; n > 0; n--) {
85+ len = 0;
86+ for (; n > 0; n--) {
87 len <<= 8;
88 len |= data[dp++];
89 }
90+check_length:
91+ if (len > datalen - dp)
92+ goto data_overrun_error;
93 dp += len;
94 goto next_tag;
95
96--
97cgit v0.12
98
diff --git a/recipes-kernel/linux/linux-qoriq_4.1.bb b/recipes-kernel/linux/linux-qoriq_4.1.bb
index ac0f25fe..c97104e9 100644
--- a/recipes-kernel/linux/linux-qoriq_4.1.bb
+++ b/recipes-kernel/linux/linux-qoriq_4.1.bb
@@ -16,6 +16,7 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
16 file://CVE-2016-5696-limiting-of-all-challenge.patch \ 16 file://CVE-2016-5696-limiting-of-all-challenge.patch \
17 file://CVE-2016-5696-make-challenge-acks-less-predictable.patch \ 17 file://CVE-2016-5696-make-challenge-acks-less-predictable.patch \
18 file://CVE-2016-2053.patch \ 18 file://CVE-2016-2053.patch \
19 file://CVE-2016-0758.patch \
19" 20"
20SRCREV = "667e6ba9ca2150b3cabdd0c07b57d1b88ef3b86a" 21SRCREV = "667e6ba9ca2150b3cabdd0c07b57d1b88ef3b86a"
21 22