Adds patch to backport fix for CVE-2023-41910. Signed-off-by: Colin McAllister <[email protected]> Change-Id: Iab619f1f5ba26b1141dffea065c90ef0b180b46e --- .../lldpd/files/CVE-2023-41910.patch | 26 +++++++++++++++++++ .../recipes-daemons/lldpd/lldpd_1.0.8.bb | 1 + 2 files changed, 27 insertions(+) create mode 100644 meta-networking/recipes-daemons/lldpd/files/CVE-2023-41910.patch
diff --git a/meta-networking/recipes-daemons/lldpd/files/CVE-2023-41910.patch b/meta-networking/recipes-daemons/lldpd/files/CVE-2023-41910.patch new file mode 100644 index 000000000..11f6fffd7 --- /dev/null +++ b/meta-networking/recipes-daemons/lldpd/files/CVE-2023-41910.patch @@ -0,0 +1,26 @@ +From ce7c3f84d80435a1bfad77ab8cb0e9ba401f1eea Mon Sep 17 00:00:00 2001 +From: Vincent Bernat <[email protected]> +Date: Wed, 12 Apr 2023 07:38:31 +0200 +Subject: [PATCH] daemon: fix read overflow when parsing CDP addresses + +Upstream-status: Backport [https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b] +CVE: CVE-2023-41910 +--- + src/daemon/protocols/cdp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/daemon/protocols/cdp.c b/src/daemon/protocols/cdp.c +index 4a14ff0..c3a7c22 100644 +--- a/src/daemon/protocols/cdp.c ++++ b/src/daemon/protocols/cdp.c +@@ -483,6 +483,7 @@ cdp_decode(struct lldpd *cfg, char *frame, int s, + goto malformed; + } + PEEK_DISCARD(address_len); ++ addresses_len -= address_len; + (void)PEEK_SAVE(pos_next_address); + /* Next, we go back and try to extract + IPv4 address */ +-- +2.47.1 + diff --git a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.8.bb b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.8.bb index cf2b156fe..022bb62dd 100644 --- a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.8.bb +++ b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.8.bb @@ -9,6 +9,7 @@ SRC_URI = "\ http://media.luffy.cx/files/${BPN}/${BPN}-${PV}.tar.gz \ file://lldpd.init.d \ file://lldpd.default \ + file://CVE-2023-41910.patch \ " SRC_URI[md5sum] = "000042dbf5b445f750b5ba01ab25c8ba" -- 2.47.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#114606): https://lists.openembedded.org/g/openembedded-devel/message/114606 Mute This Topic: https://lists.openembedded.org/mt/110357330/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
