summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnkur Tyagi <ankur.tyagi85@gmail.com>2026-01-17 22:45:31 +1300
committerAnuj Mittal <anuj.mittal@oss.qualcomm.com>2026-01-19 12:15:45 +0530
commitb3da92e178eaccf191e07de20551aa2d36338de2 (patch)
tree8e9508d7f2f55e6373244904c457ebd2ded34cd4
parent85f404194e154696800e06c7122da772dd4a7f08 (diff)
downloadmeta-openembedded-b3da92e178eaccf191e07de20551aa2d36338de2.tar.gz
gpsd: patch CVE-2025-67269
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67269 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Diffstat
-rw-r--r--meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67269.patch150
-rw-r--r--meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb1
2 files changed, 151 insertions, 0 deletions
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67269.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67269.patch
new file mode 100644
index 0000000000..6967f2ba12
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67269.patch
@@ -0,0 +1,150 @@
1From 0a0448c7d5dabe0eef940108c6e85de16e45e757 Mon Sep 17 00:00:00 2001
2From: "Gary E. Miller" <gem@rellim.com>
3Date: Wed, 3 Dec 2025 19:04:03 -0800
4Subject: [PATCH] gpsd/packet.c: Fix integer underflow is malicious Navcom
5 packet
6
7Causes DoS. Fix issue 358
8
9CVE: CVE-2025-67269
10Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7]
11Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
12---
13 gpsd/packet.c | 63 ++++++++++++++++++++++++++++++++++++++-------------
14 1 file changed, 47 insertions(+), 16 deletions(-)
15
16diff --git a/gpsd/packet.c b/gpsd/packet.c
17index 8e14a17ff..51c51ced9 100644
18--- a/gpsd/packet.c
19+++ b/gpsd/packet.c
20@@ -947,18 +947,22 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
21 #endif // SIRF_ENABLE || SKYTRAQ_ENABLE
22 #ifdef SIRF_ENABLE
23 case SIRF_LEADER_2:
24- // first part of length
25- lexer->length = (size_t) (c << 8);
26+ // first part of length, MSB
27+ lexer->length = (c & 0x7f) << 8;
28+ if (lexer->length > MAX_PACKET_LENGTH) {
29+ lexer->length = 0;
30+ return character_pushback(lexer, GROUND_STATE);
31+ } // else
32 lexer->state = SIRF_LENGTH_1;
33 break;
34 case SIRF_LENGTH_1:
35 // second part of length
36 lexer->length += c + 2;
37- if (lexer->length <= MAX_PACKET_LENGTH) {
38- lexer->state = SIRF_PAYLOAD;
39- } else {
40+ if (lexer->length > MAX_PACKET_LENGTH) {
41+ lexer->length = 0;
42 return character_pushback(lexer, GROUND_STATE);
43- }
44+ } // else
45+ lexer->state = SIRF_PAYLOAD;
46 break;
47 case SIRF_PAYLOAD:
48 if (0 == --lexer->length) {
49@@ -1000,6 +1004,7 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
50 return character_pushback(lexer, GROUND_STATE);
51 }
52 if (MAX_PACKET_LENGTH < lexer->length) {
53+ lexer->length = 0;
54 return character_pushback(lexer, GROUND_STATE);
55 }
56 lexer->state = SKY_PAYLOAD;
57@@ -1182,14 +1187,29 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
58 }
59 break;
60 case NAVCOM_LEADER_3:
61+ // command ID
62 lexer->state = NAVCOM_ID;
63 break;
64 case NAVCOM_ID:
65- lexer->length = (size_t)c - 4;
66+ /* Length LSB
67+ * Navcom length includes command ID, length bytes. and checksum.
68+ * So for more than just the payload length.
69+ * Minimum 4 bytes */
70+ if (4 > c) {
71+ return character_pushback(lexer, GROUND_STATE);
72+ }
73+ lexer->length = c;
74 lexer->state = NAVCOM_LENGTH_1;
75 break;
76 case NAVCOM_LENGTH_1:
77+ // Length USB. Navcom allows payload length up to 65,531
78 lexer->length += (c << 8);
79+ // don't count ID, length and checksum in payload length
80+ lexer->length -= 4;
81+ if (MAX_PACKET_LENGTH < lexer->length) {
82+ lexer->length = 0;
83+ return character_pushback(lexer, GROUND_STATE);
84+ } // else
85 lexer->state = NAVCOM_LENGTH_2;
86 break;
87 case NAVCOM_LENGTH_2:
88@@ -1316,11 +1336,11 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
89 lexer->length += 2; // checksum
90 // 10 bytes is the length of the Zodiac header
91 // no idea what Zodiac max length really is
92- if ((MAX_PACKET_LENGTH - 10) >= lexer->length) {
93- lexer->state = ZODIAC_PAYLOAD;
94- } else {
95+ if ((MAX_PACKET_LENGTH - 10) < lexer->length) {
96+ lexer->length = 0;
97 return character_pushback(lexer, GROUND_STATE);
98- }
99+ } // else
100+ lexer->state = ZODIAC_PAYLOAD;
101 break;
102 case ZODIAC_PAYLOAD:
103 if (0 == --lexer->length) {
104@@ -1356,6 +1376,7 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
105 lexer->state = UBX_LENGTH_2;
106 } else {
107 // bad length
108+ lexer->length = 0;
109 return character_pushback(lexer, GROUND_STATE);
110 }
111 break;
112@@ -1502,16 +1523,16 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
113 lexer->state = GEOSTAR_MESSAGE_ID_2;
114 break;
115 case GEOSTAR_MESSAGE_ID_2:
116- lexer->length = (size_t)c * 4;
117+ lexer->length = c * 4;
118 lexer->state = GEOSTAR_LENGTH_1;
119 break;
120 case GEOSTAR_LENGTH_1:
121 lexer->length += (c << 8) * 4;
122- if (MAX_PACKET_LENGTH >= lexer->length) {
123- lexer->state = GEOSTAR_LENGTH_2;
124- } else {
125+ if (MAX_PACKET_LENGTH < lexer->length) {
126+ lexer->length = 0;
127 return character_pushback(lexer, GROUND_STATE);
128- }
129+ } // else
130+ lexer->state = GEOSTAR_LENGTH_2;
131 break;
132 case GEOSTAR_LENGTH_2:
133 lexer->state = GEOSTAR_PAYLOAD;
134@@ -1823,6 +1844,16 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
135 #endif // STASH_ENABLE
136 }
137
138+ /* Catch length overflow. Should not happen.
139+ * length is size_t, so underflow looks like overflow too. */
140+ if (MAX_PACKET_LENGTH <= lexer->length) {
141+ GPSD_LOG(LOG_WARN, &lexer->errout,
142+ "Too long: %zu state %u %s c x%x\n",
143+ lexer->length, lexer->state, state_table[lexer->state], c);
144+ // exit(255);
145+ lexer->length = 0;
146+ return character_pushback(lexer, GROUND_STATE);
147+ }
148 return true; // no pushback
149 }
150
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
index 3833b4179b..171060044c 100644
--- a/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
+++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
@@ -8,6 +8,7 @@ PROVIDES = "virtual/gpsd"
8SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ 8SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \
9 file://gpsd.init \ 9 file://gpsd.init \
10 file://CVE-2025-67268.patch \ 10 file://CVE-2025-67268.patch \
11 file://CVE-2025-67269.patch \
11 " 12 "
12SRC_URI[sha256sum] = "00ee13f615655284874a661be13553abe66128e6deb5cd648af9bc0cb345fe5c" 13SRC_URI[sha256sum] = "00ee13f615655284874a661be13553abe66128e6deb5cd648af9bc0cb345fe5c"
13 14
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-06-30 21:28:37 +0000