diff options
author | Yi Zhao <yi.zhao@windriver.com> | 2017-09-21 08:34:37 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-09-22 17:15:30 +0100 |
commit | 4db9f488546fda5eb287a1337bd7213005aed864 (patch) | |
tree | 16571ee495f7b8457742754df12fc954e13c1429 /meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch | |
parent | bbe55428976d1f486bf232f654cc055b87e369e0 (diff) | |
download | poky-4db9f488546fda5eb287a1337bd7213005aed864.tar.gz |
qemu: Security fixes
Fix CVE-2017-13672, CVE-2017-13673, CVE-2017-13711, CVE-2017-14167
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-13672
https://nvd.nist.gov/vuln/detail/CVE-2017-13673
https://nvd.nist.gov/vuln/detail/CVE-2017-13711
https://nvd.nist.gov/vuln/detail/CVE-2017-14167
Patches from:
CVE-2017-13672:
https://git.qemu.org/?p=qemu.git;a=commit;h=3d90c6254863693a6b13d918d2b8682e08bbc681
CVE-2017-13673:
https://git.qemu.org/?p=qemu.git;a=commit;h=e65294157d4b69393b3f819c99f4f647452b48e3
CVE-2017-13711:
https://git.qemu.org/?p=qemu.git;a=commit;h=1201d308519f1e915866d7583d5136d03cc1d384
CVE-2017-14167:
https://git.qemu.org/?p=qemu.git;a=commit;h=ed4f86e8b6eff8e600c69adee68c7cd34dd2cccb
(From OE-Core rev: acc5036a6b74a76d719e6f7224a398f47df4a041)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch | 70 |
1 files changed, 70 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch b/meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch new file mode 100644 index 0000000000..969ad877d6 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2017-14167.patch | |||
@@ -0,0 +1,70 @@ | |||
1 | From ed4f86e8b6eff8e600c69adee68c7cd34dd2cccb Mon Sep 17 00:00:00 2001 | ||
2 | From: Prasad J Pandit <pjp@fedoraproject.org> | ||
3 | Date: Thu, 7 Sep 2017 12:02:56 +0530 | ||
4 | Subject: [PATCH] multiboot: validate multiboot header address values | ||
5 | |||
6 | While loading kernel via multiboot-v1 image, (flags & 0x00010000) | ||
7 | indicates that multiboot header contains valid addresses to load | ||
8 | the kernel image. These addresses are used to compute kernel | ||
9 | size and kernel text offset in the OS image. Validate these | ||
10 | address values to avoid an OOB access issue. | ||
11 | |||
12 | This is CVE-2017-14167. | ||
13 | |||
14 | Reported-by: Thomas Garnier <thgarnie@google.com> | ||
15 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | ||
16 | Message-Id: <20170907063256.7418-1-ppandit@redhat.com> | ||
17 | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | ||
18 | |||
19 | Upstream-Status: Backport | ||
20 | [https://git.qemu.org/?p=qemu.git;a=commit;h=ed4f86e8b6eff8e600c69adee68c7cd34dd2cccb] | ||
21 | |||
22 | CVE: CVE-2017-14167 | ||
23 | |||
24 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
25 | --- | ||
26 | hw/i386/multiboot.c | 19 +++++++++++++++++++ | ||
27 | 1 file changed, 19 insertions(+) | ||
28 | |||
29 | diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c | ||
30 | index 6001f4c..c7b70c9 100644 | ||
31 | --- a/hw/i386/multiboot.c | ||
32 | +++ b/hw/i386/multiboot.c | ||
33 | @@ -221,15 +221,34 @@ int load_multiboot(FWCfgState *fw_cfg, | ||
34 | uint32_t mh_header_addr = ldl_p(header+i+12); | ||
35 | uint32_t mh_load_end_addr = ldl_p(header+i+20); | ||
36 | uint32_t mh_bss_end_addr = ldl_p(header+i+24); | ||
37 | + | ||
38 | mh_load_addr = ldl_p(header+i+16); | ||
39 | + if (mh_header_addr < mh_load_addr) { | ||
40 | + fprintf(stderr, "invalid mh_load_addr address\n"); | ||
41 | + exit(1); | ||
42 | + } | ||
43 | + | ||
44 | uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr); | ||
45 | uint32_t mb_load_size = 0; | ||
46 | mh_entry_addr = ldl_p(header+i+28); | ||
47 | |||
48 | if (mh_load_end_addr) { | ||
49 | + if (mh_bss_end_addr < mh_load_addr) { | ||
50 | + fprintf(stderr, "invalid mh_bss_end_addr address\n"); | ||
51 | + exit(1); | ||
52 | + } | ||
53 | mb_kernel_size = mh_bss_end_addr - mh_load_addr; | ||
54 | + | ||
55 | + if (mh_load_end_addr < mh_load_addr) { | ||
56 | + fprintf(stderr, "invalid mh_load_end_addr address\n"); | ||
57 | + exit(1); | ||
58 | + } | ||
59 | mb_load_size = mh_load_end_addr - mh_load_addr; | ||
60 | } else { | ||
61 | + if (kernel_file_size < mb_kernel_text_offset) { | ||
62 | + fprintf(stderr, "invalid kernel_file_size\n"); | ||
63 | + exit(1); | ||
64 | + } | ||
65 | mb_kernel_size = kernel_file_size - mb_kernel_text_offset; | ||
66 | mb_load_size = mb_kernel_size; | ||
67 | } | ||
68 | -- | ||
69 | 2.7.4 | ||
70 | |||