summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch41
-rw-r--r--meta/recipes-core/busybox/busybox_1.23.2.bb1
2 files changed, 0 insertions, 42 deletions
diff --git a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch
deleted file mode 100644
index 4e76067b3c..0000000000
--- a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch
+++ /dev/null
@@ -1,41 +0,0 @@
1Upstream-status: Backport
2http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b
3
4CVE-2014-9645 fix.
5
6[YOCTO #7257]
7
8Signed-off-by: Armin Kuster <akuster@mvista.com>
9
10From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001
11From: Denys Vlasenko <vda.linux@googlemail.com>
12Date: Thu, 20 Nov 2014 17:24:33 +0000
13Subject: modprobe,rmmod: reject module names with slashes
14
15function old new delta
16add_probe 86 113 +27
17
18Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
19---
20Index: busybox-1.22.1/modutils/modprobe.c
21===================================================================
22--- busybox-1.22.1.orig/modutils/modprobe.c
23+++ busybox-1.22.1/modutils/modprobe.c
24@@ -238,6 +238,17 @@ static void add_probe(const char *name)
25 {
26 struct module_entry *m;
27
28+ /*
29+ * get_or_add_modentry() strips path from name and works
30+ * on remaining basename.
31+ * This would make "rmmod dir/name" and "modprobe dir/name"
32+ * to work like "rmmod name" and "modprobe name",
33+ * which is wrong, and can be abused via implicit modprobing:
34+ * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial.
35+ */
36+ if (strchr(name, '/'))
37+ bb_error_msg_and_die("malformed module name '%s'", name);
38+
39 m = get_or_add_modentry(name);
40 if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS))
41 && (m->flags & MODULE_FLAG_LOADED)
diff --git a/meta/recipes-core/busybox/busybox_1.23.2.bb b/meta/recipes-core/busybox/busybox_1.23.2.bb
index 0af292df6f..b1b90327dd 100644
--- a/meta/recipes-core/busybox/busybox_1.23.2.bb
+++ b/meta/recipes-core/busybox/busybox_1.23.2.bb
@@ -30,7 +30,6 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
30 file://login-utilities.cfg \ 30 file://login-utilities.cfg \
31 file://recognize_connmand.patch \ 31 file://recognize_connmand.patch \
32 file://busybox-cross-menuconfig.patch \ 32 file://busybox-cross-menuconfig.patch \
33 file://CVE-2014-9645_busybox_reject_module_names_with_slashes.patch \
34" 33"
35 34
36SRC_URI[tarball.md5sum] = "7925683d7dd105aabe9b6b618d48cc73" 35SRC_URI[tarball.md5sum] = "7925683d7dd105aabe9b6b618d48cc73"