net: nfs: Fix CVE-2022-30767 (old CVE-2019-14196)

This patch mitigates the vulnerability identified via CVE-2019-14196.

The previous patch was bypassed/ineffective, and now the vulnerability
is identified via CVE-2022-30767. The patch removes the sanity check
introduced to mitigate CVE-2019-14196 since it's ineffective.
filefh3_length is changed to unsigned type integer, preventing negative
numbers from being used during comparison with positive values during
size sanity checks.

Signed-off-by: Andrea zi0Black Cappa <zi0Black@protonmail.com>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/bdbf7a05e26f3c5fd437c99e2755ffde186ddc80
Bug: https://lists.denx.de/pipermail/u-boot/2022-May/483952.htmll
Bug-Debian: https://bugs.debian.org/1014471
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-30767
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2022-30767

Gbp-Pq: Name CVE-2022-30767.patch

diff --git a/net/nfs.c b/net/nfs.c
index 70d0e08bde9201a4aaa3e4f5cb02e43324dc0bc6..3003f54aac45b86f16bf1e1d4313f50d6f2839f0 100644 (file)
--- a/net/nfs.c
+++ b/net/nfs.c
@@ -57,7 +57,7 @@ static ulong nfs_timeout = NFS_TIMEOUT;
 
 static char dirfh[NFS_FHSIZE]; /* NFSv2 / NFSv3 file handle of directory */
 static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */
-static int filefh3_length;     /* (variable) length of filefh when NFSv3 */
+static unsigned int filefh3_length;    /* (variable) length of filefh when NFSv3 */
 
 static enum net_loop_state nfs_download_state;
 static struct in_addr nfs_server_ip;
@@ -578,8 +578,6 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len)
                filefh3_length = ntohl(rpc_pkt.u.reply.data[1]);
                if (filefh3_length > NFS3_FHSIZE)
                        filefh3_length  = NFS3_FHSIZE;
-               if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len)
-                       return -NFS_RPC_DROP;
                memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length);
        }