From: Andrea zi0Black Cappa Date: Wed, 18 May 2022 16:30:08 +0000 (+0000) Subject: net: nfs: Fix CVE-2022-30767 (old CVE-2019-14196) X-Git-Tag: archive/raspbian/2021.01+dfsg-5+rpi1+deb11u2^2~16 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=de7fe47886aa41b76fe476fdb856f574e473e883;p=u-boot.git net: nfs: Fix CVE-2022-30767 (old CVE-2019-14196) This patch mitigates the vulnerability identified via CVE-2019-14196. The previous patch was bypassed/ineffective, and now the vulnerability is identified via CVE-2022-30767. The patch removes the sanity check introduced to mitigate CVE-2019-14196 since it's ineffective. filefh3_length is changed to unsigned type integer, preventing negative numbers from being used during comparison with positive values during size sanity checks. Signed-off-by: Andrea zi0Black Cappa Reviewed-By: Daniel Leidert Origin: https://source.denx.de/u-boot/u-boot/-/commit/bdbf7a05e26f3c5fd437c99e2755ffde186ddc80 Bug: https://lists.denx.de/pipermail/u-boot/2022-May/483952.htmll Bug-Debian: https://bugs.debian.org/1014471 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-30767 Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2022-30767 Gbp-Pq: Name CVE-2022-30767.patch --- diff --git a/net/nfs.c b/net/nfs.c index 70d0e08bd..3003f54aa 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -57,7 +57,7 @@ static ulong nfs_timeout = NFS_TIMEOUT; static char dirfh[NFS_FHSIZE]; /* NFSv2 / NFSv3 file handle of directory */ static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */ -static int filefh3_length; /* (variable) length of filefh when NFSv3 */ +static unsigned int filefh3_length; /* (variable) length of filefh when NFSv3 */ static enum net_loop_state nfs_download_state; static struct in_addr nfs_server_ip; @@ -578,8 +578,6 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len) filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); if (filefh3_length > NFS3_FHSIZE) filefh3_length = NFS3_FHSIZE; - if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len) - return -NFS_RPC_DROP; memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); }