diff options
Diffstat (limited to 'meta/recipes-devtools')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2020-14364.patch | 93 |
2 files changed, 94 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 012be74855..ec32c90ad5 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -42,6 +42,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
42 | file://CVE-2020-16092.patch \ | 42 | file://CVE-2020-16092.patch \ |
43 | file://CVE-2020-10756.patch \ | 43 | file://CVE-2020-10756.patch \ |
44 | file://CVE-2020-15863.patch \ | 44 | file://CVE-2020-15863.patch \ |
45 | file://CVE-2020-14364.patch \ | ||
45 | " | 46 | " |
46 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 47 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
47 | 48 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-14364.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-14364.patch new file mode 100644 index 0000000000..a109ac08d6 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-14364.patch | |||
@@ -0,0 +1,93 @@ | |||
1 | From b946434f2659a182afc17e155be6791ebfb302eb Mon Sep 17 00:00:00 2001 | ||
2 | From: Gerd Hoffmann <kraxel@redhat.com> | ||
3 | Date: Tue, 25 Aug 2020 07:36:36 +0200 | ||
4 | Subject: [PATCH] usb: fix setup_len init (CVE-2020-14364) | ||
5 | |||
6 | Store calculated setup_len in a local variable, verify it, and only | ||
7 | write it to the struct (USBDevice->setup_len) in case it passed the | ||
8 | sanity checks. | ||
9 | |||
10 | This prevents other code (do_token_{in,out} functions specifically) | ||
11 | from working with invalid USBDevice->setup_len values and overrunning | ||
12 | the USBDevice->setup_buf[] buffer. | ||
13 | |||
14 | Fixes: CVE-2020-14364 | ||
15 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | ||
16 | Tested-by: Gonglei <arei.gonglei@huawei.com> | ||
17 | Reviewed-by: Li Qiang <liq3ea@gmail.com> | ||
18 | Message-id: 20200825053636.29648-1-kraxel@redhat.com | ||
19 | |||
20 | Upstream-Status: Backport | ||
21 | CVE: CVE-2020-14364 | ||
22 | [https://git.qemu.org/?p=qemu.git;a=patch;h=b946434f2659a182afc17e155be6791ebfb302eb] | ||
23 | Signed-off-by: Li Wang <li.wang@windriver.com> | ||
24 | --- | ||
25 | hw/usb/core.c | 16 ++++++++++------ | ||
26 | 1 file changed, 10 insertions(+), 6 deletions(-) | ||
27 | |||
28 | diff --git a/hw/usb/core.c b/hw/usb/core.c | ||
29 | index 5abd128..5234dcc 100644 | ||
30 | --- a/hw/usb/core.c | ||
31 | +++ b/hw/usb/core.c | ||
32 | @@ -129,6 +129,7 @@ void usb_wakeup(USBEndpoint *ep, unsigned int stream) | ||
33 | static void do_token_setup(USBDevice *s, USBPacket *p) | ||
34 | { | ||
35 | int request, value, index; | ||
36 | + unsigned int setup_len; | ||
37 | |||
38 | if (p->iov.size != 8) { | ||
39 | p->status = USB_RET_STALL; | ||
40 | @@ -138,14 +139,15 @@ static void do_token_setup(USBDevice *s, USBPacket *p) | ||
41 | usb_packet_copy(p, s->setup_buf, p->iov.size); | ||
42 | s->setup_index = 0; | ||
43 | p->actual_length = 0; | ||
44 | - s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; | ||
45 | - if (s->setup_len > sizeof(s->data_buf)) { | ||
46 | + setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; | ||
47 | + if (setup_len > sizeof(s->data_buf)) { | ||
48 | fprintf(stderr, | ||
49 | "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", | ||
50 | - s->setup_len, sizeof(s->data_buf)); | ||
51 | + setup_len, sizeof(s->data_buf)); | ||
52 | p->status = USB_RET_STALL; | ||
53 | return; | ||
54 | } | ||
55 | + s->setup_len = setup_len; | ||
56 | |||
57 | request = (s->setup_buf[0] << 8) | s->setup_buf[1]; | ||
58 | value = (s->setup_buf[3] << 8) | s->setup_buf[2]; | ||
59 | @@ -259,26 +261,28 @@ static void do_token_out(USBDevice *s, USBPacket *p) | ||
60 | static void do_parameter(USBDevice *s, USBPacket *p) | ||
61 | { | ||
62 | int i, request, value, index; | ||
63 | + unsigned int setup_len; | ||
64 | |||
65 | for (i = 0; i < 8; i++) { | ||
66 | s->setup_buf[i] = p->parameter >> (i*8); | ||
67 | } | ||
68 | |||
69 | s->setup_state = SETUP_STATE_PARAM; | ||
70 | - s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; | ||
71 | s->setup_index = 0; | ||
72 | |||
73 | request = (s->setup_buf[0] << 8) | s->setup_buf[1]; | ||
74 | value = (s->setup_buf[3] << 8) | s->setup_buf[2]; | ||
75 | index = (s->setup_buf[5] << 8) | s->setup_buf[4]; | ||
76 | |||
77 | - if (s->setup_len > sizeof(s->data_buf)) { | ||
78 | + setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; | ||
79 | + if (setup_len > sizeof(s->data_buf)) { | ||
80 | fprintf(stderr, | ||
81 | "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", | ||
82 | - s->setup_len, sizeof(s->data_buf)); | ||
83 | + setup_len, sizeof(s->data_buf)); | ||
84 | p->status = USB_RET_STALL; | ||
85 | return; | ||
86 | } | ||
87 | + s->setup_len = setup_len; | ||
88 | |||
89 | if (p->pid == USB_TOKEN_OUT) { | ||
90 | usb_packet_copy(p, s->data_buf, s->setup_len); | ||
91 | -- | ||
92 | 2.17.1 | ||
93 | |||