From d3f677a56013b1706854b016cde4dd4c4bc281fd Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Tue, 28 Apr 2015 09:27:21 +0200 Subject: qemu-slirp: CVE-2014-3640 Fixes a NULL pointer deref in sosendto() References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640 Signed-off-by: Sona Sarmadi --- ...dp-NULL-pointer-dereference-CVE-2014-3640.patch | 45 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_1.7.2.bb | 3 +- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch diff --git a/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch new file mode 100644 index 0000000000..e45644f08c --- /dev/null +++ b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch @@ -0,0 +1,45 @@ +From 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a Mon Sep 17 00:00:00 2001 +From: Petr Matousek +Date: Thu, 18 Sep 2014 08:35:37 +0200 +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of + uninitialized socket + +When guest sends udp packet with source port and source addr 0, +uninitialized socket is picked up when looking for matching and already +created udp sockets, and later passed to sosendto() where NULL pointer +dereference is hit during so->slirp->vnetwork_mask.s_addr access. + +Fix this by checking that the socket is not just a socket stub. + +This is CVE-2014-3640. +Upstream-Status: Backport + +Signed-off-by: Petr Matousek +Reported-by: Xavier Mehrenberger +Reported-by: Stephane Duverger +Reviewed-by: Jan Kiszka +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Michael Tokarev +Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com +Signed-off-by: Peter Maydell +Signed-off-by: Sona Sarmadi +--- + slirp/udp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/slirp/udp.c b/slirp/udp.c +index 8cc6cb6..f77e00f 100644 +--- a/slirp/udp.c ++++ b/slirp/udp.c +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) + * Locate pcb for datagram. + */ + so = slirp->udp_last_so; +- if (so->so_lport != uh->uh_sport || ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || + so->so_laddr.s_addr != ip->ip_src.s_addr) { + struct socket *tmp; + +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_1.7.2.bb b/meta/recipes-devtools/qemu/qemu_1.7.2.bb index e2e0c86a06..60a7937219 100644 --- a/meta/recipes-devtools/qemu/qemu_1.7.2.bb +++ b/meta/recipes-devtools/qemu/qemu_1.7.2.bb @@ -6,7 +6,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \ SRC_URI += "file://fxrstorssefix.patch \ file://qemu-enlarge-env-entry-size.patch \ file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \ - file://ide-CVE-2014-2894.patch" + file://ide-CVE-2014-2894.patch \ + file://slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch" SRC_URI_prepend = "http://wiki.qemu.org/download/qemu-${PV}.tar.bz2" SRC_URI[md5sum] = "a52e0acd37b0c9b06228fe98da0b1b43" -- cgit v1.2.3-54-g00ecf