From 205069a9e858c595989335af32319c4720242bfd Mon Sep 17 00:00:00 2001 From: Limeng Date: Thu, 26 Sep 2019 09:46:07 +0800 Subject: u-boot: add CVE patches for u-boot Add 9 patches to fix below CVE issues. CVE-2019-13103 CVE-2019-13104 CVE-2019-13105 CVE-2019-13106 CVE-2019-14192 CVE-2019-14193 CVE-2019-14194 CVE-2019-14195 CVE-2019-14196 CVE-2019-14197 CVE-2019-14198 CVE-2019-14199 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 (From OE-Core rev: db22dbe158dcb2298bfd74ff6cbba31f67488035) Signed-off-by: Meng Li Signed-off-by: Richard Purdie --- .../u-boot/files/0001-CVE-2019-13103.patch | 69 ++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch (limited to 'meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch') diff --git a/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch b/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch new file mode 100644 index 0000000000..1a5d1eb996 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch @@ -0,0 +1,69 @@ +From 39a759494f734c4cdc3e2b919671bfb3134b41ae Mon Sep 17 00:00:00 2001 +From: Paul Emge +Date: Mon, 8 Jul 2019 16:37:03 -0700 +Subject: [PATCH 1/9] CVE-2019-13103: disk: stop infinite recursion in DOS + Partitions + +part_get_info_extended and print_partition_extended can recurse infinitely +while parsing a self-referential filesystem or one with a silly number of +extended partitions. This patch adds a limit to the number of recursive +partitions. + +Signed-off-by: Paul Emge + +Upstream-Status: Backport[http://git.denx.de/?p=u-boot.git;a=commit; + h=232e2f4fd9a24bf08215ddc8c53ccadffc841fb5] + +CVE: CVE-2019-13103 + +Signed-off-by: Meng Li +--- + disk/part_dos.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/disk/part_dos.c b/disk/part_dos.c +index 936cee0d36..aae9d95906 100644 +--- a/disk/part_dos.c ++++ b/disk/part_dos.c +@@ -23,6 +23,10 @@ + + #define DOS_PART_DEFAULT_SECTOR 512 + ++/* should this be configurable? It looks like it's not very common at all ++ * to use large numbers of partitions */ ++#define MAX_EXT_PARTS 256 ++ + /* Convert char[4] in little endian format to the host format integer + */ + static inline unsigned int le32_to_int(unsigned char *le32) +@@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, + dos_partition_t *pt; + int i; + ++ /* set a maximum recursion level */ ++ if (part_num > MAX_EXT_PARTS) ++ { ++ printf("** Nested DOS partitions detected, stopping **\n"); ++ return; ++ } ++ + if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { + printf ("** Can't read partition table on %d:" LBAFU " **\n", + dev_desc->devnum, ext_part_sector); +@@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, + int i; + int dos_type; + ++ /* set a maximum recursion level */ ++ if (part_num > MAX_EXT_PARTS) ++ { ++ printf("** Nested DOS partitions detected, stopping **\n"); ++ return -1; ++ } ++ + if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { + printf ("** Can't read partition table on %d:" LBAFU " **\n", + dev_desc->devnum, ext_part_sector); +-- +2.17.1 + -- cgit v1.2.3-54-g00ecf