diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch')
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch new file mode 100644 index 0000000000..a7ecf31c01 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch @@ -0,0 +1,48 @@ +From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001 +From: Petr Matousek <pmatouse@redhat.com> +Date: Thu, 18 Sep 2014 08:35:37 +0200 +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of + uninitialized socket + +When guest sends udp packet with source port and source addr 0, +uninitialized socket is picked up when looking for matching and already +created udp sockets, and later passed to sosendto() where NULL pointer +dereference is hit during so->slirp->vnetwork_mask.s_addr access. + +Fix this by checking that the socket is not just a socket stub. + +This is CVE-2014-3640. + +Upstream-Status: Backport + +Signed-off-by: Petr Matousek <pmatouse@redhat.com> +Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com> +Reported-by: Stephane Duverger <stephane.duverger@eads.net> +Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> +Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com +Signed-off-by: Peter Maydell <peter.maydell@linaro.org> +(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a) +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> +Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> +--- + slirp/udp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/slirp/udp.c b/slirp/udp.c +index 8cc6cb6..f77e00f 100644 +--- a/slirp/udp.c ++++ b/slirp/udp.c +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) + * Locate pcb for datagram. + */ + so = slirp->udp_last_so; +- if (so->so_lport != uh->uh_sport || ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || + so->so_laddr.s_addr != ip->ip_src.s_addr) { + struct socket *tmp; + +-- +1.9.1 + |