From 15ff8423dcca127906c0100945ec556c41f46abe Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Tue, 27 Jan 2015 17:19:28 -0800 Subject: busybox: cve-2014-9645 modprobe,rmmod: reject module names with slashes (From OE-Core rev: 815a7b6fbf3b0cf95f5464bca687d97366d7ed6a) (From OE-Core rev: 698ef44edcff82457e29baef1dd364d1fecf892b) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- ..._busybox_reject_module_names_with_slashes.patch | 41 ++++++++++++++++++++++ meta/recipes-core/busybox/busybox_1.22.1.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch (limited to 'meta/recipes-core') diff --git a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch new file mode 100644 index 0000000000..4e76067b3c --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch @@ -0,0 +1,41 @@ +Upstream-status: Backport +http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b + +CVE-2014-9645 fix. + +[YOCTO #7257] + +Signed-off-by: Armin Kuster + +From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko +Date: Thu, 20 Nov 2014 17:24:33 +0000 +Subject: modprobe,rmmod: reject module names with slashes + +function old new delta +add_probe 86 113 +27 + +Signed-off-by: Denys Vlasenko +--- +Index: busybox-1.22.1/modutils/modprobe.c +=================================================================== +--- busybox-1.22.1.orig/modutils/modprobe.c ++++ busybox-1.22.1/modutils/modprobe.c +@@ -238,6 +238,17 @@ static void add_probe(const char *name) + { + struct module_entry *m; + ++ /* ++ * get_or_add_modentry() strips path from name and works ++ * on remaining basename. ++ * This would make "rmmod dir/name" and "modprobe dir/name" ++ * to work like "rmmod name" and "modprobe name", ++ * which is wrong, and can be abused via implicit modprobing: ++ * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial. ++ */ ++ if (strchr(name, '/')) ++ bb_error_msg_and_die("malformed module name '%s'", name); ++ + m = get_or_add_modentry(name); + if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS)) + && (m->flags & MODULE_FLAG_LOADED) diff --git a/meta/recipes-core/busybox/busybox_1.22.1.bb b/meta/recipes-core/busybox/busybox_1.22.1.bb index 8879e52962..77365201b5 100644 --- a/meta/recipes-core/busybox/busybox_1.22.1.bb +++ b/meta/recipes-core/busybox/busybox_1.22.1.bb @@ -32,6 +32,7 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://0001-build-system-Specify-nostldlib-when-linking-to-.o-fi.patch \ file://recognize_connmand.patch \ file://busybox-cross-menuconfig.patch \ + file://CVE-2014-9645_busybox_reject_module_names_with_slashes.patch \ " SRC_URI[tarball.md5sum] = "337d1a15ab1cb1d4ed423168b1eb7d7e" -- cgit v1.2.3-54-g00ecf