[PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution

Following Jincheng's report, an out-of-band write leading to arbitrary
code execution is possible because on one side the squashfs logic
accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
accepts directory names up to 255 bytes long.

Prevent such an exploit from happening by capping directory name sizes
to 255. Use a define for this purpose so that developers can link the
limitation to its source and eventually kill it some day by dynamically
allocating this array (if ever desired).

Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Jincheng Wang <jc.w4ng@gmail.com>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/2ac0baab4aff1a0b45067d0b62f00c15f4e86856
Bug: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/
Bug-Debian: https://bugs.debian.org/1014528
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-33103
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2022-33103

Gbp-Pq: Name CVE-2022-33103.patch

diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index e6e8b06061e35a839644a21537fc903b1b949710..a2922a48e809a61921d3a98ccac3fe9aa7accf5c 100644 (file)
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -1057,9 +1057,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
                return -SQFS_STOP_READDIR;
        }
 
-       /* Set entry name */
-       strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);
-       dent->name[dirs->entry->name_size + 1] = '\0';
+       /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */
+       name_size = min_t(u16, dirs->entry->name_size + 1, FS_DIRENT_NAME_LEN - 1);
+       strncpy(dent->name, dirs->entry->name, name_size);
+       dent->name[name_size] = '\0';
 
        offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
        dirs->entry_count--;

diff --git a/include/fs.h b/include/fs.h
index 0794b50d102a91378d4640522acba8ad94cf178e..fb44d17c531770dd47db5b401611af9bb471918a 100644 (file)
--- a/include/fs.h
+++ b/include/fs.h
@@ -160,6 +160,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
 #define FS_DT_REG  8         /* regular file */
 #define FS_DT_LNK  10        /* symbolic link */
 
+#define FS_DIRENT_NAME_LEN 256
+
 /*
  * A directory entry, returned by fs_readdir().  Returns information
  * about the file/directory at the current directory entry position.
@@ -167,7 +169,7 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
 struct fs_dirent {
        unsigned type;       /* one of FS_DT_x (not a mask) */
        loff_t size;         /* size in bytes */
-       char name[256];
+       char name[FS_DIRENT_NAME_LEN];
 };
 
 /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */