1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
From 50d1594c2e6142a3b51d2143c74027480df082e0 Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Tue, 12 Jul 2016 13:34:54 +0200
Subject: [PATCH] libblkid: avoid non-empty recursion in EBR
This is extension to the patch 7164a1c34d18831ac61c6744ad14ce916d389b3f.
We also need to detect non-empty recursion in the EBR chain. It's
possible to create standard valid logical partitions and in the last one
points back to the EBR chain. In this case all offsets will be non-empty.
Unfortunately, it's valid to create logical partitions that are not in
the "disk order" (sorted by start offset). So link somewhere back is
valid, but this link cannot points to already existing partition
(otherwise we will see recursion).
This patch forces libblkid to ignore duplicate logical partitions, the
duplicate chain segment is interpreted as non-data segment, after 100
iterations with non-data segments it will break the loop -- no memory
is allocated in this case by the loop.
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1349536
References: http://seclists.org/oss-sec/2016/q3/40
Signed-off-by: Karel Zak <kzak@redhat.com>
Upstream-status: Backport
CVE: CVE-2016-5011 patch 2
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
libblkid/src/partitions/dos.c | 7 +++++++
libblkid/src/partitions/partitions.c | 14 ++++++++++++++
libblkid/src/partitions/partitions.h | 2 ++
3 files changed, 23 insertions(+)
Index: util-linux-2.26.2/libblkid/src/partitions/dos.c
===================================================================
--- util-linux-2.26.2.orig/libblkid/src/partitions/dos.c
+++ util-linux-2.26.2/libblkid/src/partitions/dos.c
@@ -105,6 +105,13 @@ static int parse_dos_extended(blkid_prob
continue;
}
+ /* Avoid recursive non-empty links, see ct_nodata counter */
+ if (blkid_partlist_get_partition_by_start(ls, abs_start)) {
+ DBG(LOWPROBE, ul_debug("#%d: EBR duplicate data partition [abs start=%u] -- ignore",
+ i + 1, abs_start));
+ continue;
+ }
+
par = blkid_partlist_add_partition(ls, tab, abs_start, size);
if (!par)
return -ENOMEM;
Index: util-linux-2.26.2/libblkid/src/partitions/partitions.c
===================================================================
--- util-linux-2.26.2.orig/libblkid/src/partitions/partitions.c
+++ util-linux-2.26.2/libblkid/src/partitions/partitions.c
@@ -940,6 +940,20 @@ blkid_partition blkid_partlist_get_parti
return &ls->parts[n];
}
+blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start)
+{
+ int i, nparts;
+ blkid_partition par;
+
+ nparts = blkid_partlist_numof_partitions(ls);
+ for (i = 0; i < nparts; i++) {
+ par = blkid_partlist_get_partition(ls, i);
+ if ((uint64_t) blkid_partition_get_start(par) == start)
+ return par;
+ }
+ return NULL;
+}
+
/**
* blkid_partlist_get_partition_by_partno
* @ls: partitions list
Index: util-linux-2.26.2/libblkid/src/partitions/partitions.h
===================================================================
--- util-linux-2.26.2.orig/libblkid/src/partitions/partitions.h
+++ util-linux-2.26.2/libblkid/src/partitions/partitions.h
@@ -21,6 +21,8 @@ extern int blkid_partlist_increment_part
extern blkid_partition blkid_partlist_get_parent(blkid_partlist ls);
+extern blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start);
+
extern int blkid_partitions_do_subprobe(blkid_probe pr,
blkid_partition parent, const struct blkid_idinfo *id);
|
