buffer overflow in stellaris_enet emulator Reference to upstream patch: http://git.qemu.org/?p=qemu.git;a=patch;h=3a15cc0e1ee7168db0782133d2607a6bfa422d66
Reference: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4001 Signed-off-by: Sona Sarmadi <[email protected]> --- .../recipes-devtools/qemu/qemu/CVE-2016-4001.patch | 51 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.5.0.bb | 1 + 2 files changed, 52 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch new file mode 100644 index 0000000..cfec8b8 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch @@ -0,0 +1,51 @@ +From 3a15cc0e1ee7168db0782133d2607a6bfa422d66 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <[email protected]> +Date: Fri, 8 Apr 2016 11:33:48 +0530 +Subject: [PATCH] net: stellaris_enet: check packet length against receive + buffer + +When receiving packets over Stellaris ethernet controller, it +uses receive buffer of size 2048 bytes. In case the controller +accepts large(MTU) packets, it could lead to memory corruption. +Add check to avoid it. + +CVE: CVE-2016-4001 +Upstream-Status: Backport + +Reported-by: Oleksandr Bazhaniuk <[email protected]> +Signed-off-by: Prasad J Pandit <[email protected]> +Message-id: [email protected] +Reviewed-by: Peter Maydell <[email protected]> +Signed-off-by: Peter Maydell <[email protected]> +Signed-off-by: Sona Sarmadi <[email protected]> +--- + hw/net/stellaris_enet.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c +index 84cf60b..6880894 100644 +--- a/hw/net/stellaris_enet.c ++++ b/hw/net/stellaris_enet.c +@@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si + n = s->next_packet + s->np; + if (n >= 31) + n -= 31; +- s->np++; + ++ if (size >= sizeof(s->rx[n].data) - 6) { ++ /* If the packet won't fit into the ++ * emulated 2K RAM, this is reported ++ * as a FIFO overrun error. ++ */ ++ s->ris |= SE_INT_FOV; ++ stellaris_enet_update(s); ++ return -1; ++ } ++ ++ s->np++; + s->rx[n].len = size + 6; + p = s->rx[n].data; + *(p++) = (size + 6); +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.5.0.bb b/meta/recipes-devtools/qemu/qemu_2.5.0.bb index b965f69..6823b62 100644 --- a/meta/recipes-devtools/qemu/qemu_2.5.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.5.0.bb @@ -28,6 +28,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://CVE-2016-5403.patch \ file://CVE-2016-4441.patch \ file://CVE-2016-4952.patch \ + file://CVE-2016-4001.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"; SRC_URI[md5sum] = "f469f2330bbe76e3e39db10e9ac4f8db" -- 1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
