mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-05 02:50:46 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: patch CVE-2025-2153

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2153

Pick the patch that resolved the issue from the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari
2025-10-14 16:55:24 +02:00
committed by Khem Raj
parent 32bbc37d2a
commit a66568152a
2 changed files with 52 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/hdf5/files/0001-Fix-CVE-2025-2153-5795.patch
+47
View File
@@ -0,0 +1,47 @@
From 183c8aeb601a02a38dd6815bcb651a7317b1b647 Mon Sep 17 00:00:00 2001
From: Glenn Song <43005495+glennsong09@users.noreply.github.com>
Date: Thu, 9 Oct 2025 07:51:49 -0500
Subject: [PATCH] Fix CVE-2025-2153 (#5795)
This PR fixes #5329. Previously, the message flags field was able to be modified such that a message that is not sharable according to the share_flags field in H5O_msg_class_t could be treated as sharable. A check has been added to make sure messages that are not sharable can't be modified so that they indicate they can be shared.
The bug was first reproduced using the fuzzer and the POC file from #5329. With this change, the heap based buffer overflow no longer occurs.
CVE: CVE-2025-2153
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/38954615fc079538aa45d48097625a6d76aceef0]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/H5Ocache.c | 4 ++--
src/H5Omessage.c | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/H5Ocache.c b/src/H5Ocache.c
index 87f321c..12c30cf 100644
--- a/src/H5Ocache.c
+++ b/src/H5Ocache.c
@@ -1399,8 +1399,8 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
else {
/* Check for message of unshareable class marked as "shareable"
*/
- if ((flags & H5O_MSG_FLAG_SHAREABLE) && H5O_msg_class_g[id] &&
- !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
+ if (((flags & H5O_MSG_FLAG_SHARED) || (flags & H5O_MSG_FLAG_SHAREABLE)) &&
+ H5O_msg_class_g[id] && !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL,
"message of unshareable class flagged as shareable");
diff --git a/src/H5Omessage.c b/src/H5Omessage.c
index 7190e46..fb9006c 100644
--- a/src/H5Omessage.c
+++ b/src/H5Omessage.c
@@ -354,6 +354,9 @@ H5O__msg_write_real(H5F_t *f, H5O_t *oh, const H5O_msg_class_t *type, unsigned m
*/
assert(!(mesg_flags & H5O_MSG_FLAG_DONTSHARE));
+ /* Sanity check to see if the type is not sharable */
+ assert(type->share_flags & H5O_SHARE_IS_SHARABLE);
+
/* Remove the old message from the SOHM index */
/* (It would be more efficient to try to share the message first, then
* delete it (avoiding thrashing the index in the case the ref.
meta-oe/recipes-support/hdf5/hdf5_1.14.6.bb
+5 -5
View File
@@ -11,11 +11,11 @@ inherit cmake siteinfo qemu multilib_header multilib_script
DEPENDS += "qemu-native zlib"
SRC_URI = " \
https://support.hdfgroup.org/releases/hdf5/v1_14/v1_14_6/downloads/${BPN}-${PV}.tar.gz \
file://0002-Remove-suffix-shared-from-shared-library-name.patch \
file://0001-cmake-remove-build-flags.patch \
"
SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v1_14/v1_14_6/downloads/${BPN}-${PV}.tar.gz \
file://0002-Remove-suffix-shared-from-shared-library-name.patch \
file://0001-cmake-remove-build-flags.patch \
file://0001-Fix-CVE-2025-2153-5795.patch \
"
SRC_URI[sha256sum] = "e4defbac30f50d64e1556374aa49e574417c9e72c6b1de7a4ff88c4b1bea6e9b"
FILES:${PN} += "${libdir}/libhdf5.settings ${datadir}/*"