From dc70442747324183fcde614b358b131ae13d2cfb Mon Sep 17 00:00:00 2001 From: Roy Li Date: Wed, 6 May 2015 17:09:41 +0800 Subject: e2fsprogs: fix the CVE-2015-1572 Backport a patch to fix CVE-2015-1572 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1572 (From OE-Core rev: 203e1024cc7517cad28423cc04f641376cc8f2f5) (From OE-Core rev: 7cfbeeec098e19bd27e342cd09a3fa22de6e7e93) Signed-off-by: Roy Li Signed-off-by: Richard Purdie --- ...-fix-potential-buffer-overflow-in-closefs.patch | 58 ++++++++++++++++++++++ .../recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb | 1 + 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch (limited to 'meta/recipes-devtools') diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch new file mode 100644 index 0000000..72f77cc --- /dev/null +++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch @@ -0,0 +1,58 @@ +From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Fri, 6 Feb 2015 12:46:39 -0500 +Subject: [PATCH] libext2fs: fix potential buffer overflow in closefs() + +Upstream-Status: Backport + +The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if +s_first_meta_bg is too big" had a typo in the fix for +ext2fs_closefs(). In practice most of the security exposure was from +the openfs path, since this meant if there was a carefully crafted +file system, buffer overrun would be triggered when the file system was +opened. + +However, if corrupted file system didn't trip over some corruption +check, and then the file system was modified via tune2fs or debugfs, +such that the superblock was marked dirty and then written out via the +closefs() path, it's possible that the buffer overrun could be +triggered when the file system is closed. + +Also clear up a signed vs unsigned warning while we're at it. + +Thanks to Nick Kralevich for asking me to look at +compiler warning in the code in question, which led me to notice the +bug in f66e6ce4446. + +Addresses: CVE-2015-1572 + +Signed-off-by: Theodore Ts'o +--- + lib/ext2fs/closefs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c +index 1f99113..ab5b2fb 100644 +--- a/lib/ext2fs/closefs.c ++++ b/lib/ext2fs/closefs.c +@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags) + dgrp_t j; + #endif + char *group_ptr; +- int old_desc_blocks; ++ blk64_t old_desc_blocks; + struct ext2fs_numeric_progress_struct progress; + + EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS); +@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags) + group_ptr = (char *) group_shadow; + if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) { + old_desc_blocks = fs->super->s_first_meta_bg; +- if (old_desc_blocks > fs->super->s_first_meta_bg) ++ if (old_desc_blocks > fs->desc_blocks) + old_desc_blocks = fs->desc_blocks; + } else + old_desc_blocks = fs->desc_blocks; +-- +2.1.0 + diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb index 66065bc..8ddf92d 100644 --- a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb +++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb @@ -21,6 +21,7 @@ SRC_URI += "file://acinclude.m4 \ file://misc-mke2fs.c-return-error-when-failed-to-populate-fs.patch \ file://cache_inode.patch \ file://CVE-2015-0247.patch \ + file://0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch \ " SRC_URI[md5sum] = "3f8e41e63b432ba114b33f58674563f7" -- cgit v1.1