diff options
| author |   Armin Kuster <akuster@mvista.com> | 2016-01-29 12:35:18 -0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2016-01-30 12:08:37 +0000 |
| commit | e6e9be51f77c9531f49cebe0ca6b495c23cf022d (patch) | |
| tree | cd1bf2d8ad9ea2f3bebca670820e9ff3731e54e3 /meta | |
| parent | b01b569d7d7e651a35fa38750462f13aeb64a2f3 (diff) | |
| download | openembedded-core-contrib-e6e9be51f77c9531f49cebe0ca6b495c23cf022d.tar.gz | |
qemu: Security fix CVE-2015-7512
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mod
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch | 44 | ||||
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 |
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch new file mode 100644 index 0000000000..50b8a6cee8 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch @@ -0,0 +1,44 @@ +From 8b98a2f07175d46c3f7217639bd5e03f2ec56343 Mon Sep 17 00:00:00 2001 +From: Jason Wang <jasowang@redhat.com> +Date: Mon, 30 Nov 2015 15:00:06 +0800 +Subject: [PATCH] pcnet: fix rx buffer overflow(CVE-2015-7512) + +Backends could provide a packet whose length is greater than buffer +size. Check for this and truncate the packet to avoid rx buffer +overflow in this case. + +Cc: Prasad J Pandit <pjp@fedoraproject.org> +Cc: qemu-stable@nongnu.org +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Signed-off-by: Jason Wang <jasowang@redhat.com> + +Upsteam_Status: Backport + +http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343 + +CVE: CVE-2015-7512 +[Yocto # 9013] + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/net/pcnet.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +Index: qemu-2.4.0/hw/net/pcnet.c +=================================================================== +--- qemu-2.4.0.orig/hw/net/pcnet.c ++++ qemu-2.4.0/hw/net/pcnet.c +@@ -1065,6 +1065,12 @@ ssize_t pcnet_receive(NetClientState *nc + int pktcount = 0; + + if (!s->looptest) { ++ if (size > 4092) { ++#ifdef PCNET_DEBUG_RMD ++ fprintf(stderr, "pcnet: truncates rx packet.\n"); ++#endif ++ size = 4092; ++ } + memcpy(src, buf, size); + /* no need to compute the CRC */ + src[size] = 0; diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb index 58ce3b59de..b5c717c8e1 100644 --- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb @@ -12,6 +12,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://no-valgrind.patch \ file://CVE-2015-8504.patch \ file://CVE-2015-7504.patch \ + file://CVE-2015-7512.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4" |