Fixes NULL pointer deref in sosendto(). Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640
Upstream patch: http://git.qemu.org/?p=qemu.git;a=commit; h=9a72433843d912a45046959b1953861211d1838d Signed-off-by: Sona Sarmadi <[email protected]> --- .../qemu/qemu/slirp-CVE-2014-3640.patch | 48 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.1.0.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch new file mode 100644 index 0000000..a7ecf31 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch @@ -0,0 +1,48 @@ +From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001 +From: Petr Matousek <[email protected]> +Date: Thu, 18 Sep 2014 08:35:37 +0200 +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of + uninitialized socket + +When guest sends udp packet with source port and source addr 0, +uninitialized socket is picked up when looking for matching and already +created udp sockets, and later passed to sosendto() where NULL pointer +dereference is hit during so->slirp->vnetwork_mask.s_addr access. + +Fix this by checking that the socket is not just a socket stub. + +This is CVE-2014-3640. + +Upstream-Status: Backport + +Signed-off-by: Petr Matousek <[email protected]> +Reported-by: Xavier Mehrenberger <[email protected]> +Reported-by: Stephane Duverger <[email protected]> +Reviewed-by: Jan Kiszka <[email protected]> +Reviewed-by: Michael S. Tsirkin <[email protected]> +Reviewed-by: Michael Tokarev <[email protected]> +Message-id: [email protected] +Signed-off-by: Peter Maydell <[email protected]> +(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a) +Signed-off-by: Michael Roth <[email protected]> +Signed-off-by: Sona Sarmadi <[email protected]> +--- + slirp/udp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/slirp/udp.c b/slirp/udp.c +index 8cc6cb6..f77e00f 100644 +--- a/slirp/udp.c ++++ b/slirp/udp.c +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) + * Locate pcb for datagram. + */ + so = slirp->udp_last_so; +- if (so->so_lport != uh->uh_sport || ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || + so->so_laddr.s_addr != ip->ip_src.s_addr) { + struct socket *tmp; + +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.1.0.bb b/meta/recipes-devtools/qemu/qemu_2.1.0.bb index 444a422..92a89d6 100644 --- a/meta/recipes-devtools/qemu/qemu_2.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.1.0.bb @@ -10,6 +10,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://qemu-CVE-2015-3456.patch \ file://CVE-2014-7840.patch \ file://vnc-CVE-2014-7815.patch \ + file://slirp-CVE-2014-3640.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"; SRC_URI[md5sum] = "6726977292b448cbc7f89998fac6983b" -- 1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
