1 files changed, 41 insertions, 0 deletions

diff --git a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch
new file mode 100644
index 0000000000..4e76067b3c
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch
@@ -0,0 +1,41 @@
+Upstream-status: Backport
+http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b
+
+CVE-2014-9645 fix.
+
+[YOCTO #7257]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Thu, 20 Nov 2014 17:24:33 +0000
+Subject: modprobe,rmmod: reject module names with slashes
+
+function                                             old     new   delta
+add_probe                                             86     113     +27
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+---
+Index: busybox-1.22.1/modutils/modprobe.c
+===================================================================
+--- busybox-1.22.1.orig/modutils/modprobe.c
++++ busybox-1.22.1/modutils/modprobe.c
+@@ -238,6 +238,17 @@ static void add_probe(const char *name)
+ {
+        struct module_entry *m;
+ 
++       /*
++        * get_or_add_modentry() strips path from name and works
++        * on remaining basename.
++        * This would make "rmmod dir/name" and "modprobe dir/name"
++        * to work like "rmmod name" and "modprobe name",
++        * which is wrong, and can be abused via implicit modprobing:
++        * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial.
++        */
++       if (strchr(name, '/'))
++               bb_error_msg_and_die("malformed module name '%s'", name);
++
+        m = get_or_add_modentry(name);
+        if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS))
+         && (m->flags & MODULE_FLAG_LOADED)