aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSona Sarmadi <sona.sarmadi@enea.com>2015-04-29 11:02:18 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-05-01 12:34:06 +0100
commit5f7cdf1e1212af5e3dcf36c8817c63cc853b1a91 (patch)
tree2758861ce3a95452cab3c9ebc1efa074a8de2251
parent2590eb53a6dac90cba52edd09ea56a6bdf4c4533 (diff)
downloadopenembedded-core-5f7cdf1e1212af5e3dcf36c8817c63cc853b1a91.zip
openembedded-core-5f7cdf1e1212af5e3dcf36c8817c63cc853b1a91.tar.gz
openembedded-core-5f7cdf1e1212af5e3dcf36c8817c63cc853b1a91.tar.bz2
Qemu: CVE-2014-2894
Fixes an out of bounds memory access flaw in Qemu's IDE device model Reference http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2894 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch46
-rw-r--r--meta/recipes-devtools/qemu/qemu_1.7.0.bb3
2 files changed, 48 insertions, 1 deletions
diff --git a/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch b/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch
new file mode 100644
index 0000000..bd3566e
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch
@@ -0,0 +1,46 @@
+From c5dae2f4c50ef848f224da718154af4438862cdb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Beno=C3=AEt=20Canet?= <benoit.canet@irqsave.net>
+Date: Sat, 12 Apr 2014 22:59:50 +0200
+Subject: [PATCH] ide: Correct improper smart self test counter reset in ide
+ core.
+
+The SMART self test counter was incorrectly being reset to zero,
+not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE:
+ * We would write off the beginning of a dynamically allocated buffer
+ * We forgot the SMART history
+Fix this.
+
+Signed-off-by: Benoit Canet <benoit@irqsave.net>
+Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Cc: qemu-stable@nongnu.org
+Acked-by: Kevin Wolf <kwolf@redhat.com>
+[PMM: tweaked commit message as per suggestions from Markus]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+
+Fixes CVE-2014-2894
+Upstream-Status: Backport
+
+(cherry picked from commit 940973ae0b45c9b6817bab8e4cf4df99a9ef83d7)
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ hw/ide/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index e1f4c33..6007f6f 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -1601,7 +1601,7 @@ static bool cmd_smart(IDEState *s, uint8_t cmd)
+ case 2: /* extended self test */
+ s->smart_selftest_count++;
+ if (s->smart_selftest_count > 21) {
+- s->smart_selftest_count = 0;
++ s->smart_selftest_count = 1;
+ }
+ n = 2 + (s->smart_selftest_count - 1) * 24;
+ s->smart_selftest_data[n] = s->sector;
+--
+1.9.1
+
diff --git a/meta/recipes-devtools/qemu/qemu_1.7.0.bb b/meta/recipes-devtools/qemu/qemu_1.7.0.bb
index b776ccc..a519645 100644
--- a/meta/recipes-devtools/qemu/qemu_1.7.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_1.7.0.bb
@@ -5,7 +5,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \
SRC_URI += "file://fxrstorssefix.patch \
file://qemu-enlarge-env-entry-size.patch \
- file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch"
+ file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
+ file://ide-CVE-2014-2894.patch"
SRC_URI_prepend = "http://wiki.qemu.org/download/qemu-${PV}.tar.bz2"
SRC_URI[md5sum] = "32893941d40d052a5e649efcf06aca06"