From c3c9bc2a58c18331ba8aa482db40bd9b269f18f8 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Thu, 9 Jun 2022 16:02:06 +0200 Subject: [PATCH] [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang Signed-off-by: Miquel Raynal Tested-by: Jincheng Wang Reviewed-By: Daniel Leidert Origin: https://source.denx.de/u-boot/u-boot/-/commit/2ac0baab4aff1a0b45067d0b62f00c15f4e86856 Bug: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/ Bug-Debian: https://bugs.debian.org/1014528 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-33103 Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2022-33103 Gbp-Pq: Name CVE-2022-33103.patch --- fs/squashfs/sqfs.c | 7 ++++--- include/fs.h | 4 +++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index e6e8b0606..a2922a48e 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -1057,9 +1057,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; } - /* Set entry name */ - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); - dent->name[dirs->entry->name_size + 1] = '\0'; + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ + name_size = min_t(u16, dirs->entry->name_size + 1, FS_DIRENT_NAME_LEN - 1); + strncpy(dent->name, dirs->entry->name, name_size); + dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; diff --git a/include/fs.h b/include/fs.h index 0794b50d1..fb44d17c5 100644 --- a/include/fs.h +++ b/include/fs.h @@ -160,6 +160,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */ +#define FS_DIRENT_NAME_LEN 256 + /* * A directory entry, returned by fs_readdir(). Returns information * about the file/directory at the current directory entry position. @@ -167,7 +169,7 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, struct fs_dirent { unsigned type; /* one of FS_DT_x (not a mask) */ loff_t size; /* size in bytes */ - char name[256]; + char name[FS_DIRENT_NAME_LEN]; }; /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */ -- 2.30.2