diff options
-rw-r--r-- | meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch | 41 | ||||
-rw-r--r-- | meta/recipes-core/busybox/busybox_1.23.2.bb | 1 |
2 files changed, 0 insertions, 42 deletions
diff --git a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch deleted file mode 100644 index 4e76067b3c..0000000000 --- a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch +++ /dev/null | |||
@@ -1,41 +0,0 @@ | |||
1 | Upstream-status: Backport | ||
2 | http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b | ||
3 | |||
4 | CVE-2014-9645 fix. | ||
5 | |||
6 | [YOCTO #7257] | ||
7 | |||
8 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
9 | |||
10 | From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001 | ||
11 | From: Denys Vlasenko <vda.linux@googlemail.com> | ||
12 | Date: Thu, 20 Nov 2014 17:24:33 +0000 | ||
13 | Subject: modprobe,rmmod: reject module names with slashes | ||
14 | |||
15 | function old new delta | ||
16 | add_probe 86 113 +27 | ||
17 | |||
18 | Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> | ||
19 | --- | ||
20 | Index: busybox-1.22.1/modutils/modprobe.c | ||
21 | =================================================================== | ||
22 | --- busybox-1.22.1.orig/modutils/modprobe.c | ||
23 | +++ busybox-1.22.1/modutils/modprobe.c | ||
24 | @@ -238,6 +238,17 @@ static void add_probe(const char *name) | ||
25 | { | ||
26 | struct module_entry *m; | ||
27 | |||
28 | + /* | ||
29 | + * get_or_add_modentry() strips path from name and works | ||
30 | + * on remaining basename. | ||
31 | + * This would make "rmmod dir/name" and "modprobe dir/name" | ||
32 | + * to work like "rmmod name" and "modprobe name", | ||
33 | + * which is wrong, and can be abused via implicit modprobing: | ||
34 | + * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial. | ||
35 | + */ | ||
36 | + if (strchr(name, '/')) | ||
37 | + bb_error_msg_and_die("malformed module name '%s'", name); | ||
38 | + | ||
39 | m = get_or_add_modentry(name); | ||
40 | if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS)) | ||
41 | && (m->flags & MODULE_FLAG_LOADED) | ||
diff --git a/meta/recipes-core/busybox/busybox_1.23.2.bb b/meta/recipes-core/busybox/busybox_1.23.2.bb index 0af292df6f..b1b90327dd 100644 --- a/meta/recipes-core/busybox/busybox_1.23.2.bb +++ b/meta/recipes-core/busybox/busybox_1.23.2.bb | |||
@@ -30,7 +30,6 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ | |||
30 | file://login-utilities.cfg \ | 30 | file://login-utilities.cfg \ |
31 | file://recognize_connmand.patch \ | 31 | file://recognize_connmand.patch \ |
32 | file://busybox-cross-menuconfig.patch \ | 32 | file://busybox-cross-menuconfig.patch \ |
33 | file://CVE-2014-9645_busybox_reject_module_names_with_slashes.patch \ | ||
34 | " | 33 | " |
35 | 34 | ||
36 | SRC_URI[tarball.md5sum] = "7925683d7dd105aabe9b6b618d48cc73" | 35 | SRC_URI[tarball.md5sum] = "7925683d7dd105aabe9b6b618d48cc73" |