From: Hongxu Jia <[email protected]> According to [1], Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.
Backport a patch [2] from upstream to fix CVE-2025-24857 [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24857 [2] https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2 Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Fabien Thomas <[email protected]> --- .../u-boot/files/CVE-2025-24857.patch | 42 +++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot-common.inc | 4 +- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2025-24857.patch diff --git a/meta/recipes-bsp/u-boot/files/CVE-2025-24857.patch b/meta/recipes-bsp/u-boot/files/CVE-2025-24857.patch new file mode 100644 index 0000000000..99acd5bab1 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/CVE-2025-24857.patch @@ -0,0 +1,42 @@ +From 15a46d72515c04d0eeaca19bf0356a39efc9cf93 Mon Sep 17 00:00:00 2001 +From: Tom Rini <[email protected]> +Date: Tue, 9 Dec 2025 15:23:01 -0600 +Subject: [PATCH] fs: fat: Perform sanity checks on getsize in get_fatent() + +We do not perform a check on the value of getsize in get_fatent to +ensure that it will fit within the allocated buffer. For safety sake, +add a check now and if the value exceeds FATBUFBLOCKS use that value +instead. While not currently actively exploitable, it was in the past so +adding this check is worthwhile. + +This addresses CVE-2025-24857 and was originally reported by Harvey +Phillips of Amazon Element55. + +Signed-off-by: Tom Rini <[email protected]> + +CVE: CVE-2025-24857 +Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2] +Signed-off-by: Hongxu Jia <[email protected]> +--- + fs/fat/fat.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/fat/fat.c b/fs/fat/fat.c +index e2570e81676..f6dc7ed15fe 100644 +--- a/fs/fat/fat.c ++++ b/fs/fat/fat.c +@@ -215,6 +215,11 @@ static __u32 get_fatent(fsdata *mydata, __u32 entry) + if (flush_dirty_fat_buffer(mydata) < 0) + return -1; + ++ if (getsize > FATBUFBLOCKS) { ++ debug("getsize is too large for bufptr\n"); ++ getsize = FATBUFBLOCKS; ++ } ++ + if (disk_read(startblock, getsize, bufptr) < 0) { + debug("Error reading FAT blocks\n"); + return ret; +-- +2.49.0 + diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc index 1f17bd7d0a..5f6bd44ab7 100644 --- a/meta/recipes-bsp/u-boot/u-boot-common.inc +++ b/meta/recipes-bsp/u-boot/u-boot-common.inc @@ -14,7 +14,9 @@ PE = "1" # repo during parse SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e" -SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master" +SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \ + file://CVE-2025-24857.patch \ +" S = "${WORKDIR}/git" B = "${WORKDIR}/build"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#236503): https://lists.openembedded.org/g/openembedded-core/message/236503 Mute This Topic: https://lists.openembedded.org/mt/119164890/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
