diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch new file mode 100644 index 0000000000..e45644f08c --- /dev/null +++ b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch | |||
@@ -0,0 +1,45 @@ | |||
1 | From 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a Mon Sep 17 00:00:00 2001 | ||
2 | From: Petr Matousek <pmatouse@redhat.com> | ||
3 | Date: Thu, 18 Sep 2014 08:35:37 +0200 | ||
4 | Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of | ||
5 | uninitialized socket | ||
6 | |||
7 | When guest sends udp packet with source port and source addr 0, | ||
8 | uninitialized socket is picked up when looking for matching and already | ||
9 | created udp sockets, and later passed to sosendto() where NULL pointer | ||
10 | dereference is hit during so->slirp->vnetwork_mask.s_addr access. | ||
11 | |||
12 | Fix this by checking that the socket is not just a socket stub. | ||
13 | |||
14 | This is CVE-2014-3640. | ||
15 | Upstream-Status: Backport | ||
16 | |||
17 | Signed-off-by: Petr Matousek <pmatouse@redhat.com> | ||
18 | Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com> | ||
19 | Reported-by: Stephane Duverger <stephane.duverger@eads.net> | ||
20 | Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> | ||
21 | Reviewed-by: Michael S. Tsirkin <mst@redhat.com> | ||
22 | Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> | ||
23 | Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com | ||
24 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
25 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
26 | --- | ||
27 | slirp/udp.c | 2 +- | ||
28 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
29 | |||
30 | diff --git a/slirp/udp.c b/slirp/udp.c | ||
31 | index 8cc6cb6..f77e00f 100644 | ||
32 | --- a/slirp/udp.c | ||
33 | +++ b/slirp/udp.c | ||
34 | @@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) | ||
35 | * Locate pcb for datagram. | ||
36 | */ | ||
37 | so = slirp->udp_last_so; | ||
38 | - if (so->so_lport != uh->uh_sport || | ||
39 | + if (so == &slirp->udb || so->so_lport != uh->uh_sport || | ||
40 | so->so_laddr.s_addr != ip->ip_src.s_addr) { | ||
41 | struct socket *tmp; | ||
42 | |||
43 | -- | ||
44 | 1.9.1 | ||
45 | |||