diff options
Diffstat (limited to 'meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch')
-rw-r--r-- | meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch | 69 |
1 files changed, 69 insertions, 0 deletions
diff --git a/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch b/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch new file mode 100644 index 0000000000..1a5d1eb996 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch | |||
@@ -0,0 +1,69 @@ | |||
1 | From 39a759494f734c4cdc3e2b919671bfb3134b41ae Mon Sep 17 00:00:00 2001 | ||
2 | From: Paul Emge <paulemge@forallsecure.com> | ||
3 | Date: Mon, 8 Jul 2019 16:37:03 -0700 | ||
4 | Subject: [PATCH 1/9] CVE-2019-13103: disk: stop infinite recursion in DOS | ||
5 | Partitions | ||
6 | |||
7 | part_get_info_extended and print_partition_extended can recurse infinitely | ||
8 | while parsing a self-referential filesystem or one with a silly number of | ||
9 | extended partitions. This patch adds a limit to the number of recursive | ||
10 | partitions. | ||
11 | |||
12 | Signed-off-by: Paul Emge <paulemge@forallsecure.com> | ||
13 | |||
14 | Upstream-Status: Backport[http://git.denx.de/?p=u-boot.git;a=commit; | ||
15 | h=232e2f4fd9a24bf08215ddc8c53ccadffc841fb5] | ||
16 | |||
17 | CVE: CVE-2019-13103 | ||
18 | |||
19 | Signed-off-by: Meng Li <Meng.Li@windriver.com> | ||
20 | --- | ||
21 | disk/part_dos.c | 18 ++++++++++++++++++ | ||
22 | 1 file changed, 18 insertions(+) | ||
23 | |||
24 | diff --git a/disk/part_dos.c b/disk/part_dos.c | ||
25 | index 936cee0d36..aae9d95906 100644 | ||
26 | --- a/disk/part_dos.c | ||
27 | +++ b/disk/part_dos.c | ||
28 | @@ -23,6 +23,10 @@ | ||
29 | |||
30 | #define DOS_PART_DEFAULT_SECTOR 512 | ||
31 | |||
32 | +/* should this be configurable? It looks like it's not very common at all | ||
33 | + * to use large numbers of partitions */ | ||
34 | +#define MAX_EXT_PARTS 256 | ||
35 | + | ||
36 | /* Convert char[4] in little endian format to the host format integer | ||
37 | */ | ||
38 | static inline unsigned int le32_to_int(unsigned char *le32) | ||
39 | @@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, | ||
40 | dos_partition_t *pt; | ||
41 | int i; | ||
42 | |||
43 | + /* set a maximum recursion level */ | ||
44 | + if (part_num > MAX_EXT_PARTS) | ||
45 | + { | ||
46 | + printf("** Nested DOS partitions detected, stopping **\n"); | ||
47 | + return; | ||
48 | + } | ||
49 | + | ||
50 | if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { | ||
51 | printf ("** Can't read partition table on %d:" LBAFU " **\n", | ||
52 | dev_desc->devnum, ext_part_sector); | ||
53 | @@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, | ||
54 | int i; | ||
55 | int dos_type; | ||
56 | |||
57 | + /* set a maximum recursion level */ | ||
58 | + if (part_num > MAX_EXT_PARTS) | ||
59 | + { | ||
60 | + printf("** Nested DOS partitions detected, stopping **\n"); | ||
61 | + return -1; | ||
62 | + } | ||
63 | + | ||
64 | if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { | ||
65 | printf ("** Can't read partition table on %d:" LBAFU " **\n", | ||
66 | dev_desc->devnum, ext_part_sector); | ||
67 | -- | ||
68 | 2.17.1 | ||
69 | |||