summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoy Li <rongqing.li@windriver.com>2015-05-06 17:09:41 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-05-07 13:14:39 +0100
commit203e1024cc7517cad28423cc04f641376cc8f2f5 (patch)
tree6f2dd70c8e7ef89176f1970ab1dca4a59417e29f
parenta99047605020ea76209279e98556687c61e1da0d (diff)
downloadopenembedded-core-contrib-203e1024cc7517cad28423cc04f641376cc8f2f5.tar.gz
openembedded-core-contrib-203e1024cc7517cad28423cc04f641376cc8f2f5.tar.bz2
openembedded-core-contrib-203e1024cc7517cad28423cc04f641376cc8f2f5.zip
e2fsprogs: fix the CVE-2015-1572
Backport a patch to fix CVE-2015-1572 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1572 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch58
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb1
2 files changed, 59 insertions, 0 deletions
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch
new file mode 100644
index 0000000000..72f77cc6bd
--- /dev/null
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch
@@ -0,0 +1,58 @@
+From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 6 Feb 2015 12:46:39 -0500
+Subject: [PATCH] libext2fs: fix potential buffer overflow in closefs()
+
+Upstream-Status: Backport
+
+The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
+s_first_meta_bg is too big" had a typo in the fix for
+ext2fs_closefs(). In practice most of the security exposure was from
+the openfs path, since this meant if there was a carefully crafted
+file system, buffer overrun would be triggered when the file system was
+opened.
+
+However, if corrupted file system didn't trip over some corruption
+check, and then the file system was modified via tune2fs or debugfs,
+such that the superblock was marked dirty and then written out via the
+closefs() path, it's possible that the buffer overrun could be
+triggered when the file system is closed.
+
+Also clear up a signed vs unsigned warning while we're at it.
+
+Thanks to Nick Kralevich <nnk@google.com> for asking me to look at
+compiler warning in the code in question, which led me to notice the
+bug in f66e6ce4446.
+
+Addresses: CVE-2015-1572
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ lib/ext2fs/closefs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
+index 1f99113..ab5b2fb 100644
+--- a/lib/ext2fs/closefs.c
++++ b/lib/ext2fs/closefs.c
+@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
+ dgrp_t j;
+ #endif
+ char *group_ptr;
+- int old_desc_blocks;
++ blk64_t old_desc_blocks;
+ struct ext2fs_numeric_progress_struct progress;
+
+ EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
+ group_ptr = (char *) group_shadow;
+ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
+ old_desc_blocks = fs->super->s_first_meta_bg;
+- if (old_desc_blocks > fs->super->s_first_meta_bg)
++ if (old_desc_blocks > fs->desc_blocks)
+ old_desc_blocks = fs->desc_blocks;
+ } else
+ old_desc_blocks = fs->desc_blocks;
+--
+2.1.0
+
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb
index be1db9e89e..b3540887f3 100644
--- a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb
@@ -21,6 +21,7 @@ SRC_URI += "file://acinclude.m4 \
file://misc-mke2fs.c-return-error-when-failed-to-populate-fs.patch \
file://cache_inode.patch \
file://CVE-2015-0247.patch \
+ file://0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch \
"
SRC_URI[md5sum] = "3f8e41e63b432ba114b33f58674563f7"