From f7b041121e7d3c365dcf4a596ab378d5439e33c5 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Tue, 25 Aug 2015 11:50:07 +0200 Subject: qemu-slirp: CVE-2014-3640 Fixes NULL pointer deref in sosendto(). Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640 Upstream patch: http://git.qemu.org/?p=qemu.git;a=commit; h=9a72433843d912a45046959b1953861211d1838d (From OE-Core rev: f63a4f706269b4cd82c56d92f37c881de824d8bc) Signed-off-by: Sona Sarmadi Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../qemu/qemu/slirp-CVE-2014-3640.patch | 48 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.1.0.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch new file mode 100644 index 0000000000..a7ecf31c01 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch @@ -0,0 +1,48 @@ +From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001 +From: Petr Matousek +Date: Thu, 18 Sep 2014 08:35:37 +0200 +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of + uninitialized socket + +When guest sends udp packet with source port and source addr 0, +uninitialized socket is picked up when looking for matching and already +created udp sockets, and later passed to sosendto() where NULL pointer +dereference is hit during so->slirp->vnetwork_mask.s_addr access. + +Fix this by checking that the socket is not just a socket stub. + +This is CVE-2014-3640. + +Upstream-Status: Backport + +Signed-off-by: Petr Matousek +Reported-by: Xavier Mehrenberger +Reported-by: Stephane Duverger +Reviewed-by: Jan Kiszka +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Michael Tokarev +Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com +Signed-off-by: Peter Maydell +(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a) +Signed-off-by: Michael Roth +Signed-off-by: Sona Sarmadi +--- + slirp/udp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/slirp/udp.c b/slirp/udp.c +index 8cc6cb6..f77e00f 100644 +--- a/slirp/udp.c ++++ b/slirp/udp.c +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) + * Locate pcb for datagram. + */ + so = slirp->udp_last_so; +- if (so->so_lport != uh->uh_sport || ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || + so->so_laddr.s_addr != ip->ip_src.s_addr) { + struct socket *tmp; + +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.1.0.bb b/meta/recipes-devtools/qemu/qemu_2.1.0.bb index 444a4220bd..92a89d699c 100644 --- a/meta/recipes-devtools/qemu/qemu_2.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.1.0.bb @@ -10,6 +10,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://qemu-CVE-2015-3456.patch \ file://CVE-2014-7840.patch \ file://vnc-CVE-2014-7815.patch \ + file://slirp-CVE-2014-3640.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" SRC_URI[md5sum] = "6726977292b448cbc7f89998fac6983b" -- cgit v1.2.3-54-g00ecf