summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-02-06 23:14:53 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-02-07 17:23:05 (GMT)
commit94c26caff15e8192b2fbdb1de855e27cfb69a724 (patch)
tree7678ddfafe01e5a78b93206c3fc22ba37ea4e8ea
parent05f4812d15d7816da7e50337792e98f01fbfd103 (diff)
downloadpoky-94c26caff15e8192b2fbdb1de855e27cfb69a724.tar.gz
qemu: Security fix CVE-2015-8345
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list (From OE-Core rev: 99ffcd66895e4ba064542a1797057e45ec4d3220) (From OE-Core rev: e51fc319b859f44be61822d93e0b72647a02f7c6) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch73
-rw-r--r--meta/recipes-devtools/qemu/qemu_2.2.0.bb1
2 files changed, 74 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch
new file mode 100644
index 0000000..310b458
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch
@@ -0,0 +1,73 @@
1From 00837731d254908a841d69298a4f9f077babaf24 Mon Sep 17 00:00:00 2001
2From: Stefan Weil <sw@weilnetz.de>
3Date: Fri, 20 Nov 2015 08:42:33 +0100
4Subject: [PATCH] eepro100: Prevent two endless loops
5
6http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html
7shows an example how an endless loop in function action_command can
8be achieved.
9
10During my code review, I noticed a 2nd case which can result in an
11endless loop.
12
13Reported-by: Qinghao Tang <luodalongde@gmail.com>
14Signed-off-by: Stefan Weil <sw@weilnetz.de>
15Signed-off-by: Jason Wang <jasowang@redhat.com>
16
17Upstream-Status: Backport
18
19http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24
20
21CVE: CVE-2015-8345
22[Yocto # 9013]
23
24Signed-off-by: Armin Kuster <akuster@mvista.com>
25
26---
27 hw/net/eepro100.c | 16 ++++++++++++++++
28 1 file changed, 16 insertions(+)
29
30diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
31index 60333b7..685a478 100644
32--- a/hw/net/eepro100.c
33+++ b/hw/net/eepro100.c
34@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
35 #if 0
36 uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6);
37 #endif
38+ if (tx_buffer_size == 0) {
39+ /* Prevent an endless loop. */
40+ logout("loop in %s:%u\n", __FILE__, __LINE__);
41+ break;
42+ }
43 tbd_address += 8;
44 TRACE(RXTX, logout
45 ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
46@@ -855,6 +860,10 @@ static void set_multicast_list(EEPRO100State *s)
47
48 static void action_command(EEPRO100State *s)
49 {
50+ /* The loop below won't stop if it gets special handcrafted data.
51+ Therefore we limit the number of iterations. */
52+ unsigned max_loop_count = 16;
53+
54 for (;;) {
55 bool bit_el;
56 bool bit_s;
57@@ -870,6 +879,13 @@ static void action_command(EEPRO100State *s)
58 #if 0
59 bool bit_sf = ((s->tx.command & COMMAND_SF) != 0);
60 #endif
61+
62+ if (max_loop_count-- == 0) {
63+ /* Prevent an endless loop. */
64+ logout("loop in %s:%u\n", __FILE__, __LINE__);
65+ break;
66+ }
67+
68 s->cu_offset = s->tx.link;
69 TRACE(OTHER,
70 logout("val=(cu start), status=0x%04x, command=0x%04x, link=0x%08x\n",
71--
722.3.5
73
diff --git a/meta/recipes-devtools/qemu/qemu_2.2.0.bb b/meta/recipes-devtools/qemu/qemu_2.2.0.bb
index 950917e..72fda62 100644
--- a/meta/recipes-devtools/qemu/qemu_2.2.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.2.0.bb
@@ -23,6 +23,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
23 file://CVE-2015-8504.patch \ 23 file://CVE-2015-8504.patch \
24 file://CVE-2015-7504.patch \ 24 file://CVE-2015-7504.patch \
25 file://CVE-2015-7512.patch \ 25 file://CVE-2015-7512.patch \
26 file://CVE-2015-8345.patch \
26 " 27 "
27SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" 28SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
28SRC_URI[md5sum] = "f7a5e2da22d057eb838a91da7aff43c8" 29SRC_URI[md5sum] = "f7a5e2da22d057eb838a91da7aff43c8"