From 7b418aa46a9e550d63e404e3b10dc827f2772c48 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Tue, 3 Mar 2015 11:03:10 +0100 Subject: elfutils: CVE-2014-9447 directory traversal in read_long_names() Reference https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9447 Upstream commit with the analysis: https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e Signed-off-by: Sona Sarmadi --- .../elfutils/elfutils-0.148-CVE-2014-9447.patch | 51 ++++++++++++++++++++++ meta/recipes-devtools/elfutils/elfutils_0.148.bb | 3 +- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/elfutils/elfutils/elfutils-0.148-CVE-2014-9447.patch diff --git a/meta/recipes-devtools/elfutils/elfutils/elfutils-0.148-CVE-2014-9447.patch b/meta/recipes-devtools/elfutils/elfutils/elfutils-0.148-CVE-2014-9447.patch new file mode 100644 index 0000000000..8edec1b2ed --- /dev/null +++ b/meta/recipes-devtools/elfutils/elfutils/elfutils-0.148-CVE-2014-9447.patch @@ -0,0 +1,51 @@ +libelf: Fix dir traversal vuln in ar extraction. + +read_long_names terminates names at the first '/' found but +then skips one character without checking (it's supposed to +be '\n'). Hence the next name could start with any character +including '/'. This leads to a directory traversal vulnerability +at the time the contents of the archive is extracted. + +The danger is mitigated by the fact that only one '/' is +possible in a resulting filename and only in the leading position. +Hence only files in the root directory can be written via this vuln +and only when ar is executed as root. The fix for the vuln is to not +skip any characters while looking for '/'. + +Upstream commit: +https://git.fedorahosted.org/cgit/elfutils.git/commit/ +?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e + +Fixes CVE-2014-9447 +Upstream-Status: Backport + +Signed-off-by: Alexander Cherepanov +Signed-off-by: Sona Sarmadi +--- +diff -ruN a/libelf/ChangeLog b/libelf/ChangeLog +--- a/libelf/ChangeLog 2015-03-03 10:45:03.586045753 +0100 ++++ b/libelf/ChangeLog 2015-03-03 10:47:14.052545814 +0100 +@@ -1,3 +1,8 @@ ++2014-12-28 Alexander Cherepanov ++ ++ * elf_begin.c (read_long_names): Don't miss '/' right after ++ another '/'. Fixes a dir traversal vuln in ar extraction. ++ + 2010-06-14 Ulrich Drepper + + * gelf_update_shdr.c: Implicitly set ELF_F_DIRTY bit. +diff -ruN a/libelf/elf_begin.c b/libelf/elf_begin.c +--- a/libelf/elf_begin.c 2015-03-03 10:45:04.414010849 +0100 ++++ b/libelf/elf_begin.c 2015-03-03 10:45:46.736226750 +0100 +@@ -765,10 +765,7 @@ + break; + + /* NUL-terminate the string. */ +- *runp = '\0'; +- +- /* Skip the NUL byte and the \012. */ +- runp += 2; ++ *runp++ = '\0'; + + /* A sanity check. Somebody might have generated invalid + archive. */ diff --git a/meta/recipes-devtools/elfutils/elfutils_0.148.bb b/meta/recipes-devtools/elfutils/elfutils_0.148.bb index e2b8d26aee..69aaf7be3c 100644 --- a/meta/recipes-devtools/elfutils/elfutils_0.148.bb +++ b/meta/recipes-devtools/elfutils/elfutils_0.148.bb @@ -34,7 +34,8 @@ SRC_URI += "\ file://elfutils-ar-c-fix-num-passed-to-memset.patch \ file://add-ptest.patch \ file://run-ptest \ - file://avoid_parallel_tests.patch \ + file://avoid_parallel_tests.patch \ + file://elfutils-0.148-CVE-2014-9447.patch \ " # Only apply when building uclibc based target recipe SRC_URI_append_libc-uclibc = " file://uclibc-support.patch" -- cgit v1.2.3-54-g00ecf