From 128060b9853174f93dd4c45d4dc1b0acbe08388f Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Mon, 2 May 2016 09:33:25 +0200 Subject: qemu: net: CVE-2015-5278 Avoid infinite loop when receiving packets. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5278 Reference to upstream patch: http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1 Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- .../qemu/qemu/net-CVE-2015-5278.patch | 40 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/net-CVE-2015-5278.patch diff --git a/meta/recipes-devtools/qemu/qemu/net-CVE-2015-5278.patch b/meta/recipes-devtools/qemu/qemu/net-CVE-2015-5278.patch new file mode 100644 index 0000000000..5b22a23c18 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/net-CVE-2015-5278.patch @@ -0,0 +1,40 @@ +From 5a1ccdfe44946e726b4c6fda8a4493b3931a68c1 Mon Sep 17 00:00:00 2001 +From: P J P +Date: Tue, 15 Sep 2015 16:46:59 +0530 +Subject: net: avoid infinite loop when receiving packets(CVE-2015-5278) + +Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) +bytes to process network packets. While receiving packets +via ne2000_receive() routine, a local 'index' variable +could exceed the ring buffer size, leading to an infinite +loop situation. + +CVE: CVE-2015-5278 +Upstream-Status: Backport + +Reported-by: Qinghao Tang +Signed-off-by: P J P +Signed-off-by: Stefan Hajnoczi +(cherry picked from commit 737d2b3c41d59eb8f94ab7eb419b957938f24943) +Signed-off-by: Michael Roth +Signed-off-by: Sona Sarmadi +--- + hw/net/ne2000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c +index 9278571..2bdb4c9 100644 +--- a/hw/net/ne2000.c ++++ b/hw/net/ne2000.c +@@ -256,7 +256,7 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_) + if (index <= s->stop) + avail = s->stop - index; + else +- avail = 0; ++ break; + len = size; + if (len > avail) + len = avail; +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb index 444fb02e47..9435d969f5 100644 --- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb @@ -21,6 +21,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://CVE-2016-2197.patch \ file://CVE-2016-2198.patch \ file://vnc-CVE-2015-5225.patch \ + file://net-CVE-2015-5278.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4" -- cgit v1.2.3-54-g00ecf