merged to staging thanks - armin
On 08/25/2015 02:50 AM, Sona Sarmadi wrote: > Fixes NULL pointer deref in sosendto(). > > Reference: > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640 > > Upstream patch: > http://git.qemu.org/?p=qemu.git;a=commit; > h=9a72433843d912a45046959b1953861211d1838d > > Signed-off-by: Sona Sarmadi <[email protected]> > --- > .../qemu/qemu/slirp-CVE-2014-3640.patch | 48 > ++++++++++++++++++++++ > meta/recipes-devtools/qemu/qemu_2.1.0.bb | 1 + > 2 files changed, 49 insertions(+) > create mode 100644 meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch > > diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch > b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch > new file mode 100644 > index 0000000..a7ecf31 > --- /dev/null > +++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch > @@ -0,0 +1,48 @@ > +From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001 > +From: Petr Matousek <[email protected]> > +Date: Thu, 18 Sep 2014 08:35:37 +0200 > +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of > + uninitialized socket > + > +When guest sends udp packet with source port and source addr 0, > +uninitialized socket is picked up when looking for matching and already > +created udp sockets, and later passed to sosendto() where NULL pointer > +dereference is hit during so->slirp->vnetwork_mask.s_addr access. > + > +Fix this by checking that the socket is not just a socket stub. > + > +This is CVE-2014-3640. > + > +Upstream-Status: Backport > + > +Signed-off-by: Petr Matousek <[email protected]> > +Reported-by: Xavier Mehrenberger <[email protected]> > +Reported-by: Stephane Duverger <[email protected]> > +Reviewed-by: Jan Kiszka <[email protected]> > +Reviewed-by: Michael S. Tsirkin <[email protected]> > +Reviewed-by: Michael Tokarev <[email protected]> > +Message-id: [email protected] > +Signed-off-by: Peter Maydell <[email protected]> > +(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a) > +Signed-off-by: Michael Roth <[email protected]> > +Signed-off-by: Sona Sarmadi <[email protected]> > +--- > + slirp/udp.c | 2 +- > + 1 file changed, 1 insertion(+), 1 deletion(-) > + > +diff --git a/slirp/udp.c b/slirp/udp.c > +index 8cc6cb6..f77e00f 100644 > +--- a/slirp/udp.c > ++++ b/slirp/udp.c > +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) > + * Locate pcb for datagram. > + */ > + so = slirp->udp_last_so; > +- if (so->so_lport != uh->uh_sport || > ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || > + so->so_laddr.s_addr != ip->ip_src.s_addr) { > + struct socket *tmp; > + > +-- > +1.9.1 > + > diff --git a/meta/recipes-devtools/qemu/qemu_2.1.0.bb > b/meta/recipes-devtools/qemu/qemu_2.1.0.bb > index 444a422..92a89d6 100644 > --- a/meta/recipes-devtools/qemu/qemu_2.1.0.bb > +++ b/meta/recipes-devtools/qemu/qemu_2.1.0.bb > @@ -10,6 +10,7 @@ SRC_URI += > "file://configure-fix-Darwin-target-detection.patch \ > file://qemu-CVE-2015-3456.patch \ > file://CVE-2014-7840.patch \ > file://vnc-CVE-2014-7815.patch \ > + file://slirp-CVE-2014-3640.patch \ > " > SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"; > SRC_URI[md5sum] = "6726977292b448cbc7f89998fac6983b" > -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
