Miquel Raynal [Mon, 27 Jun 2022 10:20:03 +0000 (12:20 +0200)]
[PATCH] fs/squashfs: Use kcalloc when relevant
A crafted squashfs image could embed a huge number of empty metadata
blocks in order to make the amount of malloc()'d memory overflow and be
much smaller than expected. Because of this flaw, any random code
positioned at the right location in the squashfs image could be memcpy'd
from the squashfs structures into U-Boot code location while trying to
access the rearmost blocks, before being executed.
In order to prevent this vulnerability from being exploited in eg. a
secure boot environment, let's add a check over the amount of data
that is going to be allocated. Such a check could look like:
if (!elem_size || n > SIZE_MAX / elem_size)
return NULL;
The right way to do it would be to enhance the calloc() implementation
but this is quite an impacting change for such a small fix. Another
solution would be to add the check before the malloc call in the
squashfs implementation, but this does not look right. So for now, let's
use the kcalloc() compatibility function from Linux, which has this
check.
When running "i2c md 0 0 80000100", the function do_i2c_md parses the
length into an unsigned int variable named length. The value is then
moved to a signed variable:
int nbytes = length;
#define DISP_LINE_LEN 16
int linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
ret = dm_i2c_read(dev, addr, linebuf, linebytes);
On systems where integers are 32 bits wide, 0x80000100 is a negative
value to "nbytes > DISP_LINE_LEN" is false and linebytes gets assigned
0x80000100 instead of 16.
The consequence is that the function which reads from the i2c device
(dm_i2c_read or i2c_read) is called with a 16-byte stack buffer to fill
but with a size parameter which is too large. In some cases, this could
trigger a crash. But with some i2c drivers, such as drivers/i2c/nx_i2c.c
(used with "nexell,s5pxx18-i2c" bus), the size is actually truncated to
a 16-bit integer. This is because function i2c_transfer expects an
unsigned short length. In such a case, an attacker who can control the
response of an i2c device can overwrite the return address of a function
and execute arbitrary code through Return-Oriented Programming.
Fix this issue by using unsigned integers types in do_i2c_md. While at
it, make also alen unsigned, as signed sizes can cause vulnerabilities
when people forgot to check that they can be negative.
[PATCH] efi_loader: switch to non-secure mode later
Some ARMv7 boards using PSCI require to be in secure-mode when booted via
'bootz' or 'bootm'. During distro-boot 'bootefi bootmgr' is called to check
if booting via UEFI is possible.
With the change we change the switch from secure mode to non-secure mode is
moved from the UEFI subsystem setup to just before calling StartImage().
Cc: Jernej Škrabec <jernej.skrabec@gmail.com>
Reported by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Gbp-Pq: Topic upstream
Gbp-Pq: Name 0001-efi_loader-switch-to-non-secure-mode-later.patch
The patch finishes migration of CONFIG_USE_PREBOOT and CONFIG_REBOOT
to Kconfig.
Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
Gbp-Pq: Topic riscv64
Gbp-Pq: Name qemu-riscv64_smode-sifive-fu540-fix-extlinux-define-.patch
Debian's flash-kernel expect the console variable to just contain the device,
because it will set the bootargs to "console=${console}". So revert adding
"console=" to the console parameter, but also adjust the shipped bootscripts
for exynos boards to cope with it.
Bug-Debian: https://bugs.debian.org/920116 Signed-off-by: Benjamin Drung <bdrung@debian.org>
Gbp-Pq: Topic exynos
Gbp-Pq: Name 0001-arm-config-fix-default-console-only-to-specify-the-d.patch
Ensure that CONFIG_SANDBOX is set when running "make env", avoiding a
failure to build caused by config_distro_bootcmd.h following the wrong
codepath...
Gbp-Pq: Name ensure-config-sandbox-for-make-env.patch
* Non-maintainer upload by the Debian LTS team.
* d/patches/CVE-2022-34835.patch: Add patch to fix CVE-2022-34835.
- Fix an integer signedness error and resultant stack-based buffer overflow
in the 'i2c md' command that enables the corruption of the return address
pointer of the do_i2c_md function (closes: #1014529).
* d/patches/CVE-2022-33967.patch: Add patch to fix CVE-2022-33967.
- Fix a heap-based buffer overflow vulnerability due to a defect in the
metadata reading process which may lead to a denial-of-service (DoS)
condition or arbitrary code execution by loading a specially crafted
squashfs image.
* d/patches/CVE-2022-33103.patch: Add patch to fix CVE-2022-33103.
- Fix an an out-of-bounds write (closes: #1014528).
* d/patches/CVE-2022-30790.patch: Add patch to fix CVE-2022-30790 and
CVE-2022-30552.
- Fix a a Buffer Overflow (closes: #1014470).
* d/patches/CVE-2022-30767.patch: Add patch to fix CVE-2022-30767.
- Fix an unbounded memcpy with a failed length check, leading to a buffer
overflow. This issue exists due to an incorrect fix for CVE-2019-14196
(closes: #1014471).
* d/patches/CVE-2022-2347.patch: Add patch to fix CVE-2022-2347.
- Fix an unchecked length field leading to a heap overflow
(closes: #1014959).
* d/patches/CVE-2024-57254.patch: Add patch to fix CVE-2024-57254.
- Fix an integer overflow in sqfs_inode_size (closes: 1098254).
* d/patches/CVE-2024-57255.patch: Add patch to fix CVE-2024-57255.
- Fix an integer overflow in sqfs_resolve_symlink (closes: #1098254).
* d/patches/CVE-2024-57256.patch: Add patch to fix CVE-2024-57256.
- Fix an integer overflow in ext4fs_read_symlink (closes: #1098254).
* d/patches/CVE-2024-57257.patch: Add patch to fix CVE-2024-57257.
- Fix a stack consumption issue in sqfs_size possible with deep symlink
nesting (closes: #1098254).
* d/patches/CVE-2024-57258-1.patch, d/patches/CVE-2024-57258-2.patch,
d/patches/CVE-2024-57258-3.patch: Add patches to fx CVE-2024-57258.
- Fix multiple integer overflows (closes: #1098254).
* d/patches/CVE-2024-57259.patch: Add patch to fix CVE-2024-57259.
- Fix an off-by-one error resulting in a heap memory corruption in
sqfs_search_dir (closes: #1098254).
projects / u-boot.git / log