mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 04:58:26 +00:00
Code Issues Projects Releases Wiki Activity

u-boot: fix CVE-2024-57255

Browse Source 
An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1
occurs via a crafted squashfs filesystem with an inode size of 0xffffffff,
resulting in a malloc of zero and resultant memory overwrite.

https://nvd.nist.gov/vuln/detail/CVE-2024-57255

(From OE-Core rev: c3784c108f003c6663ca969585414e4a90f06606)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hongxu Jia
2025-02-19 15:04:34 +08:00
committed by Steve Sakoman
parent ec0e90ce42
commit 618c5fdb14
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
+53
View File
@@ -0,0 +1,53 @@
From 5d7ca74388544bf8c95e104517a9120e94bfe40d Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Fri, 2 Aug 2024 18:36:44 +0200
Subject: [PATCH 2/8] squashfs: Fix integer overflow in sqfs_resolve_symlink()
A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
as a consequence malloc() will do a zero allocation.
Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.
Avoid the overflow by using the __builtin_add_overflow() helper.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
CVE: CVE-2024-57255
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
fs/squashfs/sqfs.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index 1430e671..16a07c06 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -422,8 +422,10 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
char *resolved, *target;
u32 sz;
- sz = get_unaligned_le32(&sym->symlink_size);
- target = malloc(sz + 1);
+ if (__builtin_add_overflow(get_unaligned_le32(&sym->symlink_size), 1, &sz))
+ return NULL;
+
+ target = malloc(sz);
if (!target)
return NULL;
@@ -431,9 +433,9 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
* There is no trailling null byte in the symlink's target path, so a
* copy is made and a '\0' is added at its end.
*/
- target[sz] = '\0';
+ target[sz - 1] = '\0';
/* Get target name (relative path) */
- strncpy(target, sym->symlink, sz);
+ strncpy(target, sym->symlink, sz - 1);
/* Relative -> absolute path conversion */
resolved = sqfs_get_abs_path(base_path, target);
--
2.34.1
meta/recipes-bsp/u-boot/u-boot-common.inc
+1
View File
@@ -16,6 +16,7 @@ SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57254.patch \
file://CVE-2024-57255.patch \
"
S = "${WORKDIR}/git"