summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/squashfs-tools/files/CVE-2021-40153.patch253
-rw-r--r--meta/recipes-devtools/squashfs-tools/squashfs-tools_git.bb1
2 files changed, 254 insertions, 0 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/files/CVE-2021-40153.patch b/meta/recipes-devtools/squashfs-tools/files/CVE-2021-40153.patch
new file mode 100644
index 0000000000..95e2534ee4
--- /dev/null
+++ b/meta/recipes-devtools/squashfs-tools/files/CVE-2021-40153.patch
@@ -0,0 +1,253 @@
1Backport patch to fix CVE-2021-40153, and remove version update in unsquashfs.c
2for compatible.
3
4Upstream-Status: Backport [https://github.com/plougher/squashfs-tools/commit/79b5a55]
5CVE: CVE-2021-40153
6
7Signed-off-by: Kai Kang <kai.kang@windriver.com>
8
9From 79b5a555058eef4e1e7ff220c344d39f8cd09646 Mon Sep 17 00:00:00 2001
10From: Phillip Lougher <phillip@squashfs.org.uk>
11Date: Sat, 16 Jan 2021 20:08:55 +0000
12Subject: [PATCH] Unsquashfs: fix write outside destination directory exploit
13
14An issue on Github (https://github.com/plougher/squashfs-tools/issues/72)
15shows how some specially crafted Squashfs filesystems containing
16invalid file names (with '/' and ..) can cause Unsquashfs to write
17files outside of the destination directory.
18
19This commit fixes this exploit by checking all names for
20validity.
21
22In doing so I have also added checks for '.' and for names that
23are shorter than they should be (names in the file system should
24not have '\0' terminators).
25
26Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
27---
28 squashfs-tools/Makefile | 5 ++-
29 squashfs-tools/unsquash-1.c | 9 +++++-
30 squashfs-tools/unsquash-1234.c | 58 ++++++++++++++++++++++++++++++++++
31 squashfs-tools/unsquash-2.c | 9 +++++-
32 squashfs-tools/unsquash-3.c | 9 +++++-
33 squashfs-tools/unsquash-4.c | 9 +++++-
34 squashfs-tools/unsquashfs.h | 5 ++-
35 7 files changed, 98 insertions(+), 6 deletions(-)
36 create mode 100644 squashfs-tools/unsquash-1234.c
37
38diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile
39index aee4b960..20feaca2 100644
40--- a/squashfs-tools/Makefile
41+++ b/squashfs-tools/Makefile
42@@ -156,7 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \
43 caches-queues-lists.o
44
45 UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
46- unsquash-4.o unsquash-123.o unsquash-34.o swap.o compressor.o unsquashfs_info.o
47+ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \
48+ compressor.o unsquashfs_info.o
49
50 CFLAGS ?= -O2
51 CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
52@@ -350,6 +351,8 @@ unsquash-123.o: unsquashfs.h unsquash-123.c squashfs_fs.h squashfs_compat.h
53
54 unsquash-34.o: unsquashfs.h unsquash-34.c
55
56+unsquash-1234.o: unsquash-1234.c
57+
58 unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
59
60 unsquashfs_info.o: unsquashfs.h squashfs_fs.h
61diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
62index 34eced36..28326cb1 100644
63--- a/squashfs-tools/unsquash-1.c
64+++ b/squashfs-tools/unsquash-1.c
65@@ -2,7 +2,7 @@
66 * Unsquash a squashfs filesystem. This is a highly compressed read only
67 * filesystem.
68 *
69- * Copyright (c) 2009, 2010, 2011, 2012, 2019
70+ * Copyright (c) 2009, 2010, 2011, 2012, 2019, 2021
71 * Phillip Lougher <phillip@squashfs.org.uk>
72 *
73 * This program is free software; you can redistribute it and/or
74@@ -285,6 +285,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
75 memcpy(dire->name, directory_table + bytes,
76 dire->size + 1);
77 dire->name[dire->size + 1] = '\0';
78+
79+ /* check name for invalid characters (i.e /, ., ..) */
80+ if(check_name(dire->name, dire->size + 1) == FALSE) {
81+ ERROR("File system corrupted: invalid characters in name\n");
82+ goto corrupted;
83+ }
84+
85 TRACE("squashfs_opendir: directory entry %s, inode "
86 "%d:%d, type %d\n", dire->name,
87 dirh.start_block, dire->offset, dire->type);
88diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
89new file mode 100644
90index 00000000..c2d4f42b
91--- /dev/null
92+++ b/squashfs-tools/unsquash-1234.c
93@@ -0,0 +1,58 @@
94+/*
95+ * Unsquash a squashfs filesystem. This is a highly compressed read only
96+ * filesystem.
97+ *
98+ * Copyright (c) 2021
99+ * Phillip Lougher <phillip@squashfs.org.uk>
100+ *
101+ * This program is free software; you can redistribute it and/or
102+ * modify it under the terms of the GNU General Public License
103+ * as published by the Free Software Foundation; either version 2,
104+ * or (at your option) any later version.
105+ *
106+ * This program is distributed in the hope that it will be useful,
107+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
108+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
109+ * GNU General Public License for more details.
110+ *
111+ * You should have received a copy of the GNU General Public License
112+ * along with this program; if not, write to the Free Software
113+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
114+ *
115+ * unsquash-1234.c
116+ *
117+ * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and
118+ * unsquash-4.
119+ */
120+
121+#define TRUE 1
122+#define FALSE 0
123+/*
124+ * Check name for validity, name should not
125+ * - be ".", "./", or
126+ * - be "..", "../" or
127+ * - have a "/" anywhere in the name, or
128+ * - be shorter than the expected size
129+ */
130+int check_name(char *name, int size)
131+{
132+ char *start = name;
133+
134+ if(name[0] == '.') {
135+ if(name[1] == '.')
136+ name++;
137+ if(name[1] == '/' || name[1] == '\0')
138+ return FALSE;
139+ }
140+
141+ while(name[0] != '/' && name[0] != '\0')
142+ name ++;
143+
144+ if(name[0] == '/')
145+ return FALSE;
146+
147+ if((name - start) != size)
148+ return FALSE;
149+
150+ return TRUE;
151+}
152diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
153index 4b3d767e..474064e1 100644
154--- a/squashfs-tools/unsquash-2.c
155+++ b/squashfs-tools/unsquash-2.c
156@@ -2,7 +2,7 @@
157 * Unsquash a squashfs filesystem. This is a highly compressed read only
158 * filesystem.
159 *
160- * Copyright (c) 2009, 2010, 2013, 2019
161+ * Copyright (c) 2009, 2010, 2013, 2019, 2021
162 * Phillip Lougher <phillip@squashfs.org.uk>
163 *
164 * This program is free software; you can redistribute it and/or
165@@ -386,6 +386,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
166 memcpy(dire->name, directory_table + bytes,
167 dire->size + 1);
168 dire->name[dire->size + 1] = '\0';
169+
170+ /* check name for invalid characters (i.e /, ., ..) */
171+ if(check_name(dire->name, dire->size + 1) == FALSE) {
172+ ERROR("File system corrupted: invalid characters in name\n");
173+ goto corrupted;
174+ }
175+
176 TRACE("squashfs_opendir: directory entry %s, inode "
177 "%d:%d, type %d\n", dire->name,
178 dirh.start_block, dire->offset, dire->type);
179diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
180index 02c31fc5..65cfe4d9 100644
181--- a/squashfs-tools/unsquash-3.c
182+++ b/squashfs-tools/unsquash-3.c
183@@ -2,7 +2,7 @@
184 * Unsquash a squashfs filesystem. This is a highly compressed read only
185 * filesystem.
186 *
187- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
188+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
189 * Phillip Lougher <phillip@squashfs.org.uk>
190 *
191 * This program is free software; you can redistribute it and/or
192@@ -413,6 +413,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
193 memcpy(dire->name, directory_table + bytes,
194 dire->size + 1);
195 dire->name[dire->size + 1] = '\0';
196+
197+ /* check name for invalid characters (i.e /, ., ..) */
198+ if(check_name(dire->name, dire->size + 1) == FALSE) {
199+ ERROR("File system corrupted: invalid characters in name\n");
200+ goto corrupted;
201+ }
202+
203 TRACE("squashfs_opendir: directory entry %s, inode "
204 "%d:%d, type %d\n", dire->name,
205 dirh.start_block, dire->offset, dire->type);
206diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
207index 8475835c..aa23a841 100644
208--- a/squashfs-tools/unsquash-4.c
209+++ b/squashfs-tools/unsquash-4.c
210@@ -2,7 +2,7 @@
211 * Unsquash a squashfs filesystem. This is a highly compressed read only
212 * filesystem.
213 *
214- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
215+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
216 * Phillip Lougher <phillip@squashfs.org.uk>
217 *
218 * This program is free software; you can redistribute it and/or
219@@ -349,6 +349,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
220 memcpy(dire->name, directory_table + bytes,
221 dire->size + 1);
222 dire->name[dire->size + 1] = '\0';
223+
224+ /* check name for invalid characters (i.e /, ., ..) */
225+ if(check_name(dire->name, dire->size + 1) == FALSE) {
226+ ERROR("File system corrupted: invalid characters in name\n");
227+ goto corrupted;
228+ }
229+
230 TRACE("squashfs_opendir: directory entry %s, inode "
231 "%d:%d, type %d\n", dire->name,
232 dirh.start_block, dire->offset, dire->type);
233diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
234index 934618b2..db1da7a0 100644
235--- a/squashfs-tools/unsquashfs.h
236+++ b/squashfs-tools/unsquashfs.h
237@@ -4,7 +4,7 @@
238 * Unsquash a squashfs filesystem. This is a highly compressed read only
239 * filesystem.
240 *
241- * Copyright (c) 2009, 2010, 2013, 2014, 2019
242+ * Copyright (c) 2009, 2010, 2013, 2014, 2019, 2021
243 * Phillip Lougher <phillip@squashfs.org.uk>
244 *
245 * This program is free software; you can redistribute it and/or
246@@ -261,4 +261,7 @@ extern int read_ids(int, long long, long long, unsigned int **);
247
248 /* unsquash-34.c */
249 extern long long *alloc_index_table(int);
250+
251+/* unsquash-1234.c */
252+extern int check_name(char *, int);
253 #endif
diff --git a/meta/recipes-devtools/squashfs-tools/squashfs-tools_git.bb b/meta/recipes-devtools/squashfs-tools/squashfs-tools_git.bb
index 2b1409d78d..083e597b03 100644
--- a/meta/recipes-devtools/squashfs-tools/squashfs-tools_git.bb
+++ b/meta/recipes-devtools/squashfs-tools/squashfs-tools_git.bb
@@ -11,6 +11,7 @@ PV = "4.4"
11SRCREV = "52eb4c279cd283ed9802dd1ceb686560b22ffb67" 11SRCREV = "52eb4c279cd283ed9802dd1ceb686560b22ffb67"
12SRC_URI = "git://github.com/plougher/squashfs-tools.git;protocol=https \ 12SRC_URI = "git://github.com/plougher/squashfs-tools.git;protocol=https \
13 file://0001-squashfs-tools-fix-build-failure-against-gcc-10.patch;striplevel=2 \ 13 file://0001-squashfs-tools-fix-build-failure-against-gcc-10.patch;striplevel=2 \
14 file://CVE-2021-40153.patch;striplevel=2 \
14" 15"
15 16
16S = "${WORKDIR}/git/squashfs-tools" 17S = "${WORKDIR}/git/squashfs-tools"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-07 20:01:22 +0000