MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 12:59:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

qemu: Security fix for CVE-2016-4002

Browse Source 
affects qemu < 2.6.0

(From OE-Core rev: 6d7c10eae8b23a71eee6d59baab42d98d8fb7ff8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster 2016-09-19 19:56:19 -07:00 committed by Richard Purdie
parent 48048dcaa2
commit 6057d0aa47
2 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
meta/recipes-devtools/qemu/qemu/CVE-2016-4002.patch Normal file
View File

@ -0,0 +1,39 @@
From 7a2c32ec06533c54ddaf70136bfbd89eeaf6db16 Mon Sep 17 00:00:00 2001
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Thu, 7 Apr 2016 15:56:02 +0530
Subject: [PATCH] net: mipsnet: check packet length against buffer
When receiving packets over MIPSnet network device, it uses
receive buffer of size 1514 bytes. In case the controller
accepts large(MTU) packets, it could lead to memory corruption.
Add check to avoid it.
Reported by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 3af9187fc6caaf415ab9c0c6d92c9678f65cb17f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Upstream-Status: Backport
CVE: CVE-2016-4002
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
hw/net/mipsnet.c | 3 +++
1 file changed, 3 insertions(+)
Index: qemu-2.4.0/hw/net/mipsnet.c
===================================================================
--- qemu-2.4.0.orig/hw/net/mipsnet.c
+++ qemu-2.4.0/hw/net/mipsnet.c
@@ -82,6 +82,9 @@ static ssize_t mipsnet_receive(NetClient
if (!mipsnet_can_receive(nc))
return 0;
+ if (size >= sizeof(s->rx_buffer)) {
+ return 0;
+ }
s->busy = 1;
/* Just accept everything. */

1
meta/recipes-devtools/qemu/qemu_2.4.0.bb
View File

@ -28,6 +28,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://CVE-2016-4439.patch \
file://CVE-2016-6351_p1.patch \
file://CVE-2016-6351_p2.patch \
file://CVE-2016-4002.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"