From 815a7b6fbf3b0cf95f5464bca687d97366d7ed6a Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Tue, 27 Jan 2015 17:19:28 -0800 Subject: busybox: cve-2014-9645 modprobe,rmmod: reject module names with slashes Signed-off-by: Armin Kuster Signed-off-by: Ross Burton --- ..._busybox_reject_module_names_with_slashes.patch | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch (limited to 'meta/recipes-core/busybox/busybox') diff --git a/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch new file mode 100644 index 0000000000..4e76067b3c --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2014-9645_busybox_reject_module_names_with_slashes.patch @@ -0,0 +1,41 @@ +Upstream-status: Backport +http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b + +CVE-2014-9645 fix. + +[YOCTO #7257] + +Signed-off-by: Armin Kuster + +From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko +Date: Thu, 20 Nov 2014 17:24:33 +0000 +Subject: modprobe,rmmod: reject module names with slashes + +function old new delta +add_probe 86 113 +27 + +Signed-off-by: Denys Vlasenko +--- +Index: busybox-1.22.1/modutils/modprobe.c +=================================================================== +--- busybox-1.22.1.orig/modutils/modprobe.c ++++ busybox-1.22.1/modutils/modprobe.c +@@ -238,6 +238,17 @@ static void add_probe(const char *name) + { + struct module_entry *m; + ++ /* ++ * get_or_add_modentry() strips path from name and works ++ * on remaining basename. ++ * This would make "rmmod dir/name" and "modprobe dir/name" ++ * to work like "rmmod name" and "modprobe name", ++ * which is wrong, and can be abused via implicit modprobing: ++ * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial. ++ */ ++ if (strchr(name, '/')) ++ bb_error_msg_and_die("malformed module name '%s'", name); ++ + m = get_or_add_modentry(name); + if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS)) + && (m->flags & MODULE_FLAG_LOADED) -- cgit 1.2.3-korg