From 61df8be41c952bcb81ab2799e5772a34b8788d43 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 13 Mar 2015 12:54:03 +0100 Subject: eCryptfs: CVE-2014-9683 This fixes a 1-byte NULL write past the end of allocated memory References http://seclists.org/oss-sec/2015/q1/582 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9683 Signed-off-by: Sona Sarmadi --- .../linux/files/eCryptfs-CVE-2014-9683.patch | 41 ++++++++++++++++++++++ recipes-kernel/linux/linux-qoriq_3.12.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 recipes-kernel/linux/files/eCryptfs-CVE-2014-9683.patch (limited to 'recipes-kernel/linux') diff --git a/recipes-kernel/linux/files/eCryptfs-CVE-2014-9683.patch b/recipes-kernel/linux/files/eCryptfs-CVE-2014-9683.patch new file mode 100644 index 0000000..0cd9c95 --- /dev/null +++ b/recipes-kernel/linux/files/eCryptfs-CVE-2014-9683.patch @@ -0,0 +1,41 @@ +From 8ffea99d6f2be99790611282f326da95a84a8cab Mon Sep 17 00:00:00 2001 +From: Michael Halcrow +Date: Wed, 26 Nov 2014 09:09:16 -0800 +Subject: [PATCH] eCryptfs: Remove buggy and unnecessary write in file name + decode routine + +commit 942080643bce061c3dd9d5718d3b745dcb39a8bc upstream. + +Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the +end of the allocated buffer during encrypted filename decoding. This +fix corrects the issue by getting rid of the unnecessary 0 write when +the current bit offset is 2. + +Fixes CVE-2014-9683 +Upstream-Status: Backport + +Signed-off-by: Michael Halcrow +Reported-by: Dmitry Chernenkov +Suggested-by: Kees Cook +Signed-off-by: Tyler Hicks +Signed-off-by: Jiri Slaby +Signed-off-by: Sona Sarmadi +--- + fs/ecryptfs/crypto.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index 000eae2..bf926f7 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -1917,7 +1917,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size, + break; + case 2: + dst[dst_byte_offset++] |= (src_byte); +- dst[dst_byte_offset] = 0; + current_bit_offset = 0; + break; + } +-- +1.9.1 + diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bb b/recipes-kernel/linux/linux-qoriq_3.12.bb index f082b04..1e9e476 100644 --- a/recipes-kernel/linux/linux-qoriq_3.12.bb +++ b/recipes-kernel/linux/linux-qoriq_3.12.bb @@ -37,6 +37,7 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \ file://fs-CVE-2014-4014.patch \ file://tracing-CVE-2014-7825_CVE-2014-7826.patch \ file://security-keys-CVE-2014-9529.patch \ + file://eCryptfs-CVE-2014-9683.patch \ " SRCREV = "6619b8b55796cdf0cec04b66a71288edd3057229" -- cgit v1.2.3-54-g00ecf