mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 17:19:20 +00:00
Code Issues Projects Releases Wiki Activity

dmidecode: fixup for CVE-2023-30630

Browse Source 
The previous CVE-2023-30630_1.patch picked only the patch
"dmidecode: Write the whole dump file at once" d8cfbc808f.
But there was a refactoring which does not allow to cherry-pick it fast
forward. Resolving this conflict was not correctly done. The patch was:

+    u32 len;
+    u8 *table;
...
-    if (!(opt.flags & FLAG_QUIET))
-        pr_comment("Writing %d bytes to %s.", crafted[0x05],
-                   opt.dumpfile);
-    write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
+    dmi_table_dump(crafted, crafted[0x05], table, len);

It looks like the variables len and table have been added without
initialization.
Now this problem is solved by applying the previous refactoring as
well. Patch 1 gets replaced by Patch 1a and Patch 1b. Patch 2..4 are
rebased without changes.

(From OE-Core rev: ea069a94a213cc153528aebfc387f30215566cc7)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Adrian Freihofer
2023-08-16 12:58:20 +02:00
committed by Steve Sakoman
parent 5eab65275d
commit 3d4850b3ea
6 changed files with 394 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1a.patch
+236
View File
@@ -0,0 +1,236 @@
From ee6db10dd70b8fdc7a93cffd7cf5bc7a28f9d3d7 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Mon, 20 Feb 2023 14:53:21 +0100
Subject: [PATCH 1/5] dmidecode: Split table fetching from decoding
Clean up function dmi_table so that it does only one thing:
* dmi_table() is renamed to dmi_table_get(). It now retrieves the
DMI table, but does not process it any longer.
* Decoding or dumping the table is now done in smbios3_decode(),
smbios_decode() and legacy_decode().
No functional change.
A side effect of this change is that writing the header and body of
dump files is now done in a single location. This is required to
further consolidate the writing of dump files.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>
CVE: CVE-2023-30630
Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=39b2dd7b6ab719b920e96ed832cfb4bdd664e808]
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
---
dmidecode.c | 86 ++++++++++++++++++++++++++++++++++++++---------------
1 file changed, 62 insertions(+), 24 deletions(-)
diff --git a/dmidecode.c b/dmidecode.c
index cd2b5c9..b082c03 100644
--- a/dmidecode.c
+++ b/dmidecode.c
@@ -5247,8 +5247,9 @@ static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags)
}
}
-static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
- u32 flags)
+/* Allocates a buffer for the table, must be freed by the caller */
+static u8 *dmi_table_get(off_t base, u32 *len, u16 num, u32 ver,
+ const char *devmem, u32 flags)
{
u8 *buf;
@@ -5267,7 +5268,7 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
{
if (num)
pr_info("%u structures occupying %u bytes.",
- num, len);
+ num, *len);
if (!(opt.flags & FLAG_FROM_DUMP))
pr_info("Table at 0x%08llX.",
(unsigned long long)base);
@@ -5285,19 +5286,19 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
* would be the result of the kernel truncating the table on
* parse error.
*/
- size_t size = len;
+ size_t size = *len;
buf = read_file(flags & FLAG_NO_FILE_OFFSET ? 0 : base,
&size, devmem);
- if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)len)
+ if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)*len)
{
fprintf(stderr, "Wrong DMI structures length: %u bytes "
"announced, only %lu bytes available.\n",
- len, (unsigned long)size);
+ *len, (unsigned long)size);
}
- len = size;
+ *len = size;
}
else
- buf = mem_chunk(base, len, devmem);
+ buf = mem_chunk(base, *len, devmem);
if (buf == NULL)
{
@@ -5307,15 +5308,9 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
fprintf(stderr,
"Try compiling dmidecode with -DUSE_MMAP.\n");
#endif
- return;
}
- if (opt.flags & FLAG_DUMP_BIN)
- dmi_table_dump(buf, len);
- else
- dmi_table_decode(buf, len, num, ver >> 8, flags);
-
- free(buf);
+ return buf;
}
@@ -5350,8 +5345,9 @@ static void overwrite_smbios3_address(u8 *buf)
static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
{
- u32 ver;
+ u32 ver, len;
u64 offset;
+ u8 *table;
/* Don't let checksum run beyond the buffer */
if (buf[0x06] > 0x20)
@@ -5377,8 +5373,12 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
return 0;
}
- dmi_table(((off_t)offset.h << 32) | offset.l,
- DWORD(buf + 0x0C), 0, ver, devmem, flags | FLAG_STOP_AT_EOT);
+ /* Maximum length, may get trimmed */
+ len = DWORD(buf + 0x0C);
+ table = dmi_table_get(((off_t)offset.h << 32) | offset.l, &len, 0, ver,
+ devmem, flags | FLAG_STOP_AT_EOT);
+ if (table == NULL)
+ return 1;
if (opt.flags & FLAG_DUMP_BIN)
{
@@ -5387,18 +5387,28 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 32);
overwrite_smbios3_address(crafted);
+ dmi_table_dump(table, len);
if (!(opt.flags & FLAG_QUIET))
pr_comment("Writing %d bytes to %s.", crafted[0x06],
opt.dumpfile);
write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1);
}
+ else
+ {
+ dmi_table_decode(table, len, 0, ver >> 8,
+ flags | FLAG_STOP_AT_EOT);
+ }
+
+ free(table);
return 1;
}
static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
{
- u16 ver;
+ u16 ver, num;
+ u32 len;
+ u8 *table;
/* Don't let checksum run beyond the buffer */
if (buf[0x05] > 0x20)
@@ -5438,8 +5448,13 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
pr_info("SMBIOS %u.%u present.",
ver >> 8, ver & 0xFF);
- dmi_table(DWORD(buf + 0x18), WORD(buf + 0x16), WORD(buf + 0x1C),
- ver << 8, devmem, flags);
+ /* Maximum length, may get trimmed */
+ len = WORD(buf + 0x16);
+ num = WORD(buf + 0x1C);
+ table = dmi_table_get(DWORD(buf + 0x18), &len, num, ver << 8,
+ devmem, flags);
+ if (table == NULL)
+ return 1;
if (opt.flags & FLAG_DUMP_BIN)
{
@@ -5448,27 +5463,43 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 32);
overwrite_dmi_address(crafted + 0x10);
+ dmi_table_dump(table, len);
if (!(opt.flags & FLAG_QUIET))
pr_comment("Writing %d bytes to %s.", crafted[0x05],
opt.dumpfile);
write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
}
+ else
+ {
+ dmi_table_decode(table, len, num, ver, flags);
+ }
+
+ free(table);
return 1;
}
static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
{
+ u16 ver, num;
+ u32 len;
+ u8 *table;
+
if (!checksum(buf, 0x0F))
return 0;
+ ver = ((buf[0x0E] & 0xF0) << 4) + (buf[0x0E] & 0x0F);
if (!(opt.flags & FLAG_QUIET))
pr_info("Legacy DMI %u.%u present.",
buf[0x0E] >> 4, buf[0x0E] & 0x0F);
- dmi_table(DWORD(buf + 0x08), WORD(buf + 0x06), WORD(buf + 0x0C),
- ((buf[0x0E] & 0xF0) << 12) + ((buf[0x0E] & 0x0F) << 8),
- devmem, flags);
+ /* Maximum length, may get trimmed */
+ len = WORD(buf + 0x06);
+ num = WORD(buf + 0x0C);
+ table = dmi_table_get(DWORD(buf + 0x08), &len, num, ver << 8,
+ devmem, flags);
+ if (table == NULL)
+ return 1;
if (opt.flags & FLAG_DUMP_BIN)
{
@@ -5477,11 +5508,18 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 16);
overwrite_dmi_address(crafted);
+ dmi_table_dump(table, len);
if (!(opt.flags & FLAG_QUIET))
pr_comment("Writing %d bytes to %s.", 0x0F,
opt.dumpfile);
write_dump(0, 0x0F, crafted, opt.dumpfile, 1);
}
+ else
+ {
+ dmi_table_decode(table, len, num, ver, flags);
+ }
+
+ free(table);
return 1;
}
--
2.41.0
meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1.patch → meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1b.patch
+43 -83
View File
@@ -1,7 +1,7 @@
From d8cfbc808f387e87091c25e7d5b8c2bb348bb206 Mon Sep 17 00:00:00 2001 From d362549bce92ac22860cda8cad4532c1a3fe6928 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de> From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 27 Jun 2023 09:40:23 +0000 Date: Mon, 20 Feb 2023 14:53:25 +0100
Subject: [PATCH] dmidecode: Write the whole dump file at once Subject: [PATCH 2/5] dmidecode: Write the whole dump file at once
When option --dump-bin is used, write the whole dump file at once, When option --dump-bin is used, write the whole dump file at once,
instead of opening and closing the file separately for the table instead of opening and closing the file separately for the table
@@ -19,25 +19,23 @@ Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>
CVE: CVE-2023-30630 CVE: CVE-2023-30630
Reference: https://github.com/mirror/dmidecode/commit/39b2dd7b6ab719b920e96ed832cfb4bdd664e808 Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206]
Upstream-Status: Backport [https://github.com/mirror/dmidecode/commit/d8cfbc808f387e87091c25e7d5b8c2bb348bb206] Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
--- ---
dmidecode.c | 79 +++++++++++++++++++++++++++++++++++++++-------------- dmidecode.c | 69 +++++++++++++++++++++++++++++++++++++++--------------
util.c | 40 --------------------------- util.c | 40 -------------------------------
util.h | 1 - util.h | 1 -
3 files changed, 58 insertions(+), 62 deletions(-) 3 files changed, 51 insertions(+), 59 deletions(-)
diff --git a/dmidecode.c b/dmidecode.c diff --git a/dmidecode.c b/dmidecode.c
index 9aeff91..5477309 100644 index b082c03..a80a140 100644
--- a/dmidecode.c --- a/dmidecode.c
+++ b/dmidecode.c +++ b/dmidecode.c
@@ -5427,11 +5427,56 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver @@ -5130,11 +5130,56 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver
} }
} }
-static void dmi_table_dump(const u8 *buf, u32 len) -static void dmi_table_dump(const u8 *buf, u32 len)
+static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table, +static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table,
+ u32 table_len) + u32 table_len)
@@ -68,7 +66,7 @@ index 9aeff91..5477309 100644
+ goto err_close; + goto err_close;
+ } + }
+ +
if (!(opt.flags & FLAG_QUIET)) if (!(opt.flags & FLAG_QUIET))
- pr_comment("Writing %d bytes to %s.", len, opt.dumpfile); - pr_comment("Writing %d bytes to %s.", len, opt.dumpfile);
- write_dump(32, len, buf, opt.dumpfile, 0); - write_dump(32, len, buf, opt.dumpfile, 0);
+ pr_comment("Writing %d bytes to %s.", table_len, opt.dumpfile); + pr_comment("Writing %d bytes to %s.", table_len, opt.dumpfile);
@@ -92,94 +90,55 @@ index 9aeff91..5477309 100644
+ fclose(f); + fclose(f);
+ return -1; + return -1;
} }
static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags) static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags)
@@ -5648,11 +5693,6 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem, @@ -5387,11 +5432,7 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
return; memcpy(crafted, buf, 32);
} overwrite_smbios3_address(crafted);
- if (opt.flags & FLAG_DUMP_BIN) - dmi_table_dump(table, len);
- dmi_table_dump(buf, len);
- else
- dmi_table_decode(buf, len, num, ver >> 8, flags);
-
free(buf);
}
@@ -5688,8 +5728,9 @@ static void overwrite_smbios3_address(u8 *buf)
static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
{
- u32 ver;
+ u32 ver, len;
u64 offset;
+ u8 *table;
/* Don't let checksum run beyond the buffer */
if (buf[0x06] > 0x20)
@@ -5725,10 +5766,7 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 32);
overwrite_smbios3_address(crafted);
- if (!(opt.flags & FLAG_QUIET)) - if (!(opt.flags & FLAG_QUIET))
- pr_comment("Writing %d bytes to %s.", crafted[0x06], - pr_comment("Writing %d bytes to %s.", crafted[0x06],
- opt.dumpfile); - opt.dumpfile);
- write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1); - write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1);
+ dmi_table_dump(crafted, crafted[0x06], table, len); + dmi_table_dump(crafted, crafted[0x06], table, len);
} }
else
return 1; {
@@ -5737,6 +5775,8 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) @@ -5463,11 +5504,7 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
static int smbios_decode(u8 *buf, const char *devmem, u32 flags) memcpy(crafted, buf, 32);
{ overwrite_dmi_address(crafted + 0x10);
u16 ver;
+ u32 len; - dmi_table_dump(table, len);
+ u8 *table;
/* Don't let checksum run beyond the buffer */
if (buf[0x05] > 0x20)
@@ -5786,10 +5826,7 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 32);
overwrite_dmi_address(crafted + 0x10);
- if (!(opt.flags & FLAG_QUIET)) - if (!(opt.flags & FLAG_QUIET))
- pr_comment("Writing %d bytes to %s.", crafted[0x05], - pr_comment("Writing %d bytes to %s.", crafted[0x05],
- opt.dumpfile); - opt.dumpfile);
- write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1); - write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
+ dmi_table_dump(crafted, crafted[0x05], table, len); + dmi_table_dump(crafted, crafted[0x05], table, len);
} }
else
return 1; {
@@ -5797,6 +5834,9 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags) @@ -5508,11 +5545,7 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 16);
static int legacy_decode(u8 *buf, const char *devmem, u32 flags) overwrite_dmi_address(crafted);
{
+ u32 len; - dmi_table_dump(table, len);
+ u8 *table;
+
if (!checksum(buf, 0x0F))
return 0;
@@ -5815,10 +5855,7 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
memcpy(crafted, buf, 16);
overwrite_dmi_address(crafted);
- if (!(opt.flags & FLAG_QUIET)) - if (!(opt.flags & FLAG_QUIET))
- pr_comment("Writing %d bytes to %s.", 0x0F, - pr_comment("Writing %d bytes to %s.", 0x0F,
- opt.dumpfile); - opt.dumpfile);
- write_dump(0, 0x0F, crafted, opt.dumpfile, 1); - write_dump(0, 0x0F, crafted, opt.dumpfile, 1);
+ dmi_table_dump(crafted, 0x0F, table, len); + dmi_table_dump(crafted, 0x0F, table, len);
} }
else
return 1; {
diff --git a/util.c b/util.c diff --git a/util.c b/util.c
index 04aaadd..1547096 100644 index 04aaadd..1547096 100644
--- a/util.c --- a/util.c
+++ b/util.c +++ b/util.c
@@ -259,46 +259,6 @@ out: @@ -259,46 +259,6 @@ out:
return p; return p;
} }
-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add) -int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add)
-{ -{
- FILE *f; - FILE *f;
@@ -233,5 +192,6 @@ index 3094cf8..ef24eb9 100644
void *mem_chunk(off_t base, size_t len, const char *devmem); void *mem_chunk(off_t base, size_t len, const char *devmem);
-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add); -int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add);
u64 u64_range(u64 start, u64 end); u64 u64_range(u64 start, u64 end);
-- --
2.35.5 2.41.0
meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_2.patch
+7 -4
View File
@@ -1,7 +1,8 @@
From 47101389dd52b50123a3ec59fed4d2021752e489 Mon Sep 17 00:00:00 2001 From 2d26f187c734635d072d24ea401255b84f03f4c4 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de> From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 27 Jun 2023 10:03:53 +0000 Date: Tue, 27 Jun 2023 10:03:53 +0000
Subject: [PATCH] dmidecode: Do not let --dump-bin overwrite an existing file Subject: [PATCH 3/5] dmidecode: Do not let --dump-bin overwrite an existing
file
Make sure that the file passed to option --dump-bin does not already Make sure that the file passed to option --dump-bin does not already
exist. In practice, it is rather unlikely that an honest user would exist. In practice, it is rather unlikely that an honest user would
@@ -17,14 +18,13 @@ Upstream-Status: Backport
[https://github.com/mirror/dmidecode/commit/6ca381c1247c81f74e1ca4e7706f70bdda72e6f2] [https://github.com/mirror/dmidecode/commit/6ca381c1247c81f74e1ca4e7706f70bdda72e6f2]
Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
--- ---
dmidecode.c | 14 ++++++++++++-- dmidecode.c | 14 ++++++++++++--
man/dmidecode.8 | 3 ++- man/dmidecode.8 | 3 ++-
2 files changed, 14 insertions(+), 3 deletions(-) 2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/dmidecode.c b/dmidecode.c diff --git a/dmidecode.c b/dmidecode.c
index ae461de..6446040 100644 index a80a140..32a77cc 100644
--- a/dmidecode.c --- a/dmidecode.c
+++ b/dmidecode.c +++ b/dmidecode.c
@@ -60,6 +60,7 @@ @@ -60,6 +60,7 @@
@@ -78,3 +78,6 @@ index 64dc7e7..d5b7f01 100644
.TP .TP
.BR " " " " "--from-dump FILE" .BR " " " " "--from-dump FILE"
Read the DMI data from a binary file previously generated using Read the DMI data from a binary file previously generated using
--
2.41.0
meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_3.patch
+31 -29
View File
@@ -1,7 +1,8 @@
From c76ddda0ba0aa99a55945e3290095c2ec493c892 Mon Sep 17 00:00:00 2001 From ac881f801b92b57fd8daac65fb16fff6d84fd366 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de> From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 27 Jun 2023 10:25:50 +0000 Date: Tue, 27 Jun 2023 10:25:50 +0000
Subject: [PATCH] Consistently use read_file() when reading from a dump file Subject: [PATCH 4/5] Consistently use read_file() when reading from a dump
file
Use read_file() instead of mem_chunk() to read the entry point from a Use read_file() instead of mem_chunk() to read the entry point from a
dump file. This is faster, and consistent with how we then read the dump file. This is faster, and consistent with how we then read the
@@ -27,26 +28,26 @@ Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
1 file changed, 9 insertions(+), 2 deletions(-) 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/dmidecode.c b/dmidecode.c diff --git a/dmidecode.c b/dmidecode.c
index 98f9692..b4dbc9d 100644 index 32a77cc..9a691e0 100644
--- a/dmidecode.c --- a/dmidecode.c
+++ b/dmidecode.c +++ b/dmidecode.c
@@ -5997,17 +5997,25 @@ int main(int argc, char * const argv[]) @@ -5693,17 +5693,25 @@ int main(int argc, char * const argv[])
pr_comment("dmidecode %s", VERSION); pr_comment("dmidecode %s", VERSION);
/* Read from dump if so instructed */ /* Read from dump if so instructed */
+ size = 0x20; + size = 0x20;
if (opt.flags & FLAG_FROM_DUMP) if (opt.flags & FLAG_FROM_DUMP)
{ {
if (!(opt.flags & FLAG_QUIET)) if (!(opt.flags & FLAG_QUIET))
pr_info("Reading SMBIOS/DMI data from file %s.", pr_info("Reading SMBIOS/DMI data from file %s.",
opt.dumpfile); opt.dumpfile);
- if ((buf = mem_chunk(0, 0x20, opt.dumpfile)) == NULL) - if ((buf = mem_chunk(0, 0x20, opt.dumpfile)) == NULL)
+ if ((buf = read_file(0, &size, opt.dumpfile)) == NULL) + if ((buf = read_file(0, &size, opt.dumpfile)) == NULL)
{ {
ret = 1; ret = 1;
goto exit_free; goto exit_free;
} }
+ /* Truncated entry point can't be processed */ + /* Truncated entry point can't be processed */
+ if (size < 0x20) + if (size < 0x20)
+ { + {
@@ -54,16 +55,17 @@ index 98f9692..b4dbc9d 100644
+ goto done; + goto done;
+ } + }
+ +
if (memcmp(buf, "_SM3_", 5) == 0) if (memcmp(buf, "_SM3_", 5) == 0)
{ {
if (smbios3_decode(buf, opt.dumpfile, 0)) if (smbios3_decode(buf, opt.dumpfile, 0))
@@ -6031,7 +6039,6 @@ int main(int argc, char * const argv[]) @@ -5727,7 +5735,6 @@ int main(int argc, char * const argv[])
* contain one of several types of entry points, so read enough for * contain one of several types of entry points, so read enough for
* the largest one, then determine what type it contains. * the largest one, then determine what type it contains.
*/ */
- size = 0x20; - size = 0x20;
if (!(opt.flags & FLAG_NO_SYSFS) if (!(opt.flags & FLAG_NO_SYSFS)
&& (buf = read_file(0, &size, SYS_ENTRY_FILE)) != NULL) && (buf = read_file(0, &size, SYS_ENTRY_FILE)) != NULL)
{ {
-- --
2.40.0 2.41.0
meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_4.patch
+75 -74
View File
@@ -1,7 +1,7 @@
From 2b83c4b898f8325313162f588765411e8e3e5561 Mon Sep 17 00:00:00 2001 From 2fb126eef436389a2dc48d4225b4a9888b0625a8 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de> From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 27 Jun 2023 10:58:11 +0000 Date: Tue, 27 Jun 2023 10:58:11 +0000
Subject: [PATCH] Don't read beyond sysfs entry point buffer Subject: [PATCH 5/5] Don't read beyond sysfs entry point buffer
Functions smbios_decode() and smbios3_decode() include a check Functions smbios_decode() and smbios3_decode() include a check
against buffer overrun. This check assumes that the buffer length is against buffer overrun. This check assumes that the buffer length is
@@ -33,105 +33,106 @@ Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
1 file changed, 12 insertions(+), 12 deletions(-) 1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/dmidecode.c b/dmidecode.c diff --git a/dmidecode.c b/dmidecode.c
index b4dbc9d..870d94e 100644 index 9a691e0..e725801 100644
--- a/dmidecode.c --- a/dmidecode.c
+++ b/dmidecode.c +++ b/dmidecode.c
@@ -5736,14 +5736,14 @@ static void overwrite_smbios3_address(u8 *buf) @@ -5398,14 +5398,14 @@ static void overwrite_smbios3_address(u8 *buf)
buf[0x17] = 0; buf[0x17] = 0;
} }
-static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) -static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
+static int smbios3_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags) +static int smbios3_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags)
{ {
u32 ver, len; u32 ver, len;
u64 offset; u64 offset;
u8 *table; u8 *table;
/* Don't let checksum run beyond the buffer */ /* Don't let checksum run beyond the buffer */
- if (buf[0x06] > 0x20) - if (buf[0x06] > 0x20)
+ if (buf[0x06] > buf_len) + if (buf[0x06] > buf_len)
{ {
fprintf(stderr, fprintf(stderr,
"Entry point length too large (%u bytes, expected %u).\n", "Entry point length too large (%u bytes, expected %u).\n",
@@ -5782,14 +5782,14 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) @@ -5455,14 +5455,14 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
return 1; return 1;
} }
-static int smbios_decode(u8 *buf, const char *devmem, u32 flags) -static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
+static int smbios_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags) +static int smbios_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags)
{ {
u16 ver; u16 ver, num;
u32 len; u32 len;
u8 *table; u8 *table;
/* Don't let checksum run beyond the buffer */ /* Don't let checksum run beyond the buffer */
- if (buf[0x05] > 0x20) - if (buf[0x05] > 0x20)
+ if (buf[0x05] > buf_len) + if (buf[0x05] > buf_len)
{ {
fprintf(stderr, fprintf(stderr,
"Entry point length too large (%u bytes, expected %u).\n", "Entry point length too large (%u bytes, expected %u).\n",
@@ -6018,12 +6018,12 @@ int main(int argc, char * const argv[]) @@ -5714,12 +5714,12 @@ int main(int argc, char * const argv[])
if (memcmp(buf, "_SM3_", 5) == 0) if (memcmp(buf, "_SM3_", 5) == 0)
{ {
- if (smbios3_decode(buf, opt.dumpfile, 0)) - if (smbios3_decode(buf, opt.dumpfile, 0))
+ if (smbios3_decode(buf, size, opt.dumpfile, 0)) + if (smbios3_decode(buf, size, opt.dumpfile, 0))
found++; found++;
} }
else if (memcmp(buf, "_SM_", 4) == 0) else if (memcmp(buf, "_SM_", 4) == 0)
{ {
- if (smbios_decode(buf, opt.dumpfile, 0)) - if (smbios_decode(buf, opt.dumpfile, 0))
+ if (smbios_decode(buf, size, opt.dumpfile, 0)) + if (smbios_decode(buf, size, opt.dumpfile, 0))
found++; found++;
} }
else if (memcmp(buf, "_DMI_", 5) == 0) else if (memcmp(buf, "_DMI_", 5) == 0)
@@ -6046,12 +6046,12 @@ int main(int argc, char * const argv[]) @@ -5742,12 +5742,12 @@ int main(int argc, char * const argv[])
pr_info("Getting SMBIOS data from sysfs."); pr_info("Getting SMBIOS data from sysfs.");
if (size >= 24 && memcmp(buf, "_SM3_", 5) == 0) if (size >= 24 && memcmp(buf, "_SM3_", 5) == 0)
{ {
- if (smbios3_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) - if (smbios3_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
+ if (smbios3_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) + if (smbios3_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
found++; found++;
} }
else if (size >= 31 && memcmp(buf, "_SM_", 4) == 0) else if (size >= 31 && memcmp(buf, "_SM_", 4) == 0)
{ {
- if (smbios_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) - if (smbios_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
+ if (smbios_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) + if (smbios_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
found++; found++;
} }
else if (size >= 15 && memcmp(buf, "_DMI_", 5) == 0) else if (size >= 15 && memcmp(buf, "_DMI_", 5) == 0)
@@ -6088,12 +6088,12 @@ int main(int argc, char * const argv[]) @@ -5784,12 +5784,12 @@ int main(int argc, char * const argv[])
if (memcmp(buf, "_SM3_", 5) == 0) if (memcmp(buf, "_SM3_", 5) == 0)
{ {
- if (smbios3_decode(buf, opt.devmem, 0)) - if (smbios3_decode(buf, opt.devmem, 0))
+ if (smbios3_decode(buf, 0x20, opt.devmem, 0)) + if (smbios3_decode(buf, 0x20, opt.devmem, 0))
found++; found++;
} }
else if (memcmp(buf, "_SM_", 4) == 0) else if (memcmp(buf, "_SM_", 4) == 0)
{ {
- if (smbios_decode(buf, opt.devmem, 0)) - if (smbios_decode(buf, opt.devmem, 0))
+ if (smbios_decode(buf, 0x20, opt.devmem, 0)) + if (smbios_decode(buf, 0x20, opt.devmem, 0))
found++; found++;
} }
goto done; goto done;
@@ -6114,7 +6114,7 @@ memory_scan: @@ -5810,7 +5810,7 @@ memory_scan:
{ {
if (memcmp(buf + fp, "_SM3_", 5) == 0) if (memcmp(buf + fp, "_SM3_", 5) == 0)
{ {
- if (smbios3_decode(buf + fp, opt.devmem, 0)) - if (smbios3_decode(buf + fp, opt.devmem, 0))
+ if (smbios3_decode(buf + fp, 0x20, opt.devmem, 0)) + if (smbios3_decode(buf + fp, 0x20, opt.devmem, 0))
{ {
found++; found++;
goto done; goto done;
@@ -6127,7 +6127,7 @@ memory_scan: @@ -5823,7 +5823,7 @@ memory_scan:
{ {
if (memcmp(buf + fp, "_SM_", 4) == 0 && fp <= 0xFFE0) if (memcmp(buf + fp, "_SM_", 4) == 0 && fp <= 0xFFE0)
{ {
- if (smbios_decode(buf + fp, opt.devmem, 0)) - if (smbios_decode(buf + fp, opt.devmem, 0))
+ if (smbios_decode(buf + fp, 0x20, opt.devmem, 0)) + if (smbios_decode(buf + fp, 0x20, opt.devmem, 0))
{ {
found++; found++;
goto done; goto done;
-- --
2.35.5 2.41.0
meta/recipes-devtools/dmidecode/dmidecode_3.3.bb
+2 -1
View File
@@ -6,7 +6,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=b234ee4d69f5fce4486a80fdaf4a4263"
SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/dmidecode/${BP}.tar.xz \ SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/dmidecode/${BP}.tar.xz \
file://0001-Committing-changes-from-do_unpack_extra.patch \ file://0001-Committing-changes-from-do_unpack_extra.patch \
file://CVE-2023-30630_1.patch \ file://CVE-2023-30630_1a.patch \
file://CVE-2023-30630_1b.patch \
file://CVE-2023-30630_2.patch \ file://CVE-2023-30630_2.patch \
file://CVE-2023-30630_3.patch \ file://CVE-2023-30630_3.patch \
file://CVE-2023-30630_4.patch \ file://CVE-2023-30630_4.patch \