diff options
| author |   Sona Sarmadi <sona.sarmadi@enea.com> | 2015-08-25 11:50:07 +0200 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-09-01 21:30:27 +0100 |
| commit | f63a4f706269b4cd82c56d92f37c881de824d8bc (patch) | |
| tree | ee5123c145fb00b34ee5a7493f58d76b1e41122f | |
| parent | 4c31f726cf1ea2e01b1fbf1c23e96a110fbb9623 (diff) | |
| download | openembedded-core-f63a4f706269b4cd82c56d92f37c881de824d8bc.tar.gz | |
qemu-slirp: CVE-2014-3640
Fixes NULL pointer deref in sosendto().
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640
Upstream patch:
http://git.qemu.org/?p=qemu.git;a=commit;
h=9a72433843d912a45046959b1953861211d1838d
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch | 48 | ||||
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu_2.1.0.bb | 1 |
2 files changed, 49 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch new file mode 100644 index 0000000000..a7ecf31c01 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch @@ -0,0 +1,48 @@ +From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001 +From: Petr Matousek <pmatouse@redhat.com> +Date: Thu, 18 Sep 2014 08:35:37 +0200 +Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of + uninitialized socket + +When guest sends udp packet with source port and source addr 0, +uninitialized socket is picked up when looking for matching and already +created udp sockets, and later passed to sosendto() where NULL pointer +dereference is hit during so->slirp->vnetwork_mask.s_addr access. + +Fix this by checking that the socket is not just a socket stub. + +This is CVE-2014-3640. + +Upstream-Status: Backport + +Signed-off-by: Petr Matousek <pmatouse@redhat.com> +Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com> +Reported-by: Stephane Duverger <stephane.duverger@eads.net> +Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> +Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com +Signed-off-by: Peter Maydell <peter.maydell@linaro.org> +(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a) +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> +Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> +--- + slirp/udp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/slirp/udp.c b/slirp/udp.c +index 8cc6cb6..f77e00f 100644 +--- a/slirp/udp.c ++++ b/slirp/udp.c +@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) + * Locate pcb for datagram. + */ + so = slirp->udp_last_so; +- if (so->so_lport != uh->uh_sport || ++ if (so == &slirp->udb || so->so_lport != uh->uh_sport || + so->so_laddr.s_addr != ip->ip_src.s_addr) { + struct socket *tmp; + +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.1.0.bb b/meta/recipes-devtools/qemu/qemu_2.1.0.bb index 444a4220bd..92a89d699c 100644 --- a/meta/recipes-devtools/qemu/qemu_2.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.1.0.bb @@ -10,6 +10,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://qemu-CVE-2015-3456.patch \ file://CVE-2014-7840.patch \ file://vnc-CVE-2014-7815.patch \ + file://slirp-CVE-2014-3640.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" SRC_URI[md5sum] = "6726977292b448cbc7f89998fac6983b" |