summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSona Sarmadi <sona.sarmadi@enea.com>2015-09-03 11:53:34 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-09-19 10:53:15 (GMT)
commitbdfee8758e46b3fbb151712e831e3c5957719116 (patch)
tree5a0ce44dc6d77e9509acb4757a90d86dc427ec7d
parent915498e23033105bfacd1e1a0c083b7983a2d47e (diff)
downloadpoky-bdfee8758e46b3fbb151712e831e3c5957719116.tar.gz
gnutls: CVE-2015-3308
(From OE-Core rev: 75b25e7d463ed1af0fd9b3dd56e407e6e72b0f6a) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/gnutls/gnutls/better-fix-for-double-free-CVE-2015-3308.patch65
-rw-r--r--meta/recipes-support/gnutls/gnutls/eliminated-double-free-CVE-2015-3308.patch33
-rw-r--r--meta/recipes-support/gnutls/gnutls_3.3.5.bb2
3 files changed, 100 insertions, 0 deletions
diff --git a/meta/recipes-support/gnutls/gnutls/better-fix-for-double-free-CVE-2015-3308.patch b/meta/recipes-support/gnutls/gnutls/better-fix-for-double-free-CVE-2015-3308.patch
new file mode 100644
index 0000000..8824729
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/better-fix-for-double-free-CVE-2015-3308.patch
@@ -0,0 +1,65 @@
1From 053ae65403216acdb0a4e78b25ad66ee9f444f02 Mon Sep 17 00:00:00 2001
2From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
3Date: Sat, 28 Mar 2015 22:41:03 +0100
4Subject: [PATCH] Better fix for the double free in dist point parsing
5
6Fixes CVE-2015-3308
7Upstream-Status: Backport
8
9Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
10---
11 lib/x509/x509_ext.c | 10 ++++++----
12 1 file changed, 6 insertions(+), 4 deletions(-)
13
14diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
15index 2e69ed0..f974b02 100644
16--- a/lib/x509/x509_ext.c
17+++ b/lib/x509/x509_ext.c
18@@ -2287,7 +2287,7 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
19 int len, ret;
20 uint8_t reasons[2];
21 unsigned i, type, rflags, j;
22- gnutls_datum_t san;
23+ gnutls_datum_t san = {NULL, 0};
24
25 result = asn1_create_element
26 (_gnutls_get_pkix(), "PKIX1.CRLDistributionPoints", &c2);
27@@ -2310,9 +2310,6 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
28
29 i = 0;
30 do {
31- san.data = NULL;
32- san.size = 0;
33-
34 snprintf(name, sizeof(name), "?%u.reasons", (unsigned)i + 1);
35
36 len = sizeof(reasons);
37@@ -2337,6 +2334,9 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
38
39 j = 0;
40 do {
41+ san.data = NULL;
42+ san.size = 0;
43+
44 ret =
45 _gnutls_parse_general_name2(c2, name, j, &san,
46 &type, 0);
47@@ -2351,6 +2351,7 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
48 ret = crl_dist_points_set(cdp, type, &san, rflags);
49 if (ret < 0)
50 break;
51+ san.data = NULL; /* it is now in cdp */
52
53 j++;
54 } while (ret >= 0);
55@@ -2360,6 +2361,7 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
56
57 if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
58 gnutls_assert();
59+ gnutls_free(san.data);
60 goto cleanup;
61 }
62
63--
641.9.1
65
diff --git a/meta/recipes-support/gnutls/gnutls/eliminated-double-free-CVE-2015-3308.patch b/meta/recipes-support/gnutls/gnutls/eliminated-double-free-CVE-2015-3308.patch
new file mode 100644
index 0000000..d759b61
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/eliminated-double-free-CVE-2015-3308.patch
@@ -0,0 +1,33 @@
1From d6972be33264ecc49a86cd0958209cd7363af1e9 Mon Sep 17 00:00:00 2001
2From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
3Date: Mon, 23 Mar 2015 22:55:29 +0100
4Subject: [PATCH] eliminated double-free in the parsing of dist points
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Reported by Robert ?wi?cki.
10
11Fixes CVE-2015-3308
12Upstream-Status: Backport
13
14Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
15---
16 lib/x509/x509_ext.c | 1 -
17 1 file changed, 1 deletion(-)
18
19diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
20index c8d5867..6f09438 100644
21--- a/lib/x509/x509_ext.c
22+++ b/lib/x509/x509_ext.c
23@@ -2360,7 +2360,6 @@ int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
24
25 if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
26 gnutls_assert();
27- gnutls_free(san.data);
28 goto cleanup;
29 }
30
31--
321.9.1
33
diff --git a/meta/recipes-support/gnutls/gnutls_3.3.5.bb b/meta/recipes-support/gnutls/gnutls_3.3.5.bb
index b3daa49..9f26470 100644
--- a/meta/recipes-support/gnutls/gnutls_3.3.5.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.3.5.bb
@@ -1,6 +1,8 @@
1require gnutls.inc 1require gnutls.inc
2 2
3SRC_URI += "file://correct_rpl_gettimeofday_signature.patch \ 3SRC_URI += "file://correct_rpl_gettimeofday_signature.patch \
4 file://eliminated-double-free-CVE-2015-3308.patch \
5 file://better-fix-for-double-free-CVE-2015-3308.patch \
4 " 6 "
5 7
6SRC_URI[md5sum] = "1f396dcf3c14ea67de7243821006d1a2" 8SRC_URI[md5sum] = "1f396dcf3c14ea67de7243821006d1a2"