mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-10 10:43:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

u-boot: fix CVE-2024-57258

Browse Source 
Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1
occur for a crafted squashfs filesystem via sbrk, via request2size,
or because ptrdiff_t is mishandled on x86_64.

https://nvd.nist.gov/vuln/detail/CVE-2024-57258

(From OE-Core rev: b4bf3ba66052db7a311ac696563a8a0f9c585600)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hongxu Jia
2025-02-19 16:18:18 +08:00
committed by Steve Sakoman
parent 86f0ab4d07
commit 644ddcb993
4 changed files with 133 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch Normal file
View File

@@ -0,0 +1,47 @@
From 50ab41c3628dedeca1a331dd86dd203b73faea74 Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Fri, 2 Aug 2024 12:08:45 +0200
Subject: [PATCH 5/8] dlmalloc: Fix integer overflow in sbrk()
Make sure that the new break is within mem_malloc_start
and mem_malloc_end before making progress.
ulong new = old + increment; can overflow for extremely large
increment values and memset() can get wrongly called.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
CVE: CVE-2024-57258
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
common/dlmalloc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index de3f0422..bae2a27c 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -591,6 +591,9 @@ void *sbrk(ptrdiff_t increment)
ulong old = mem_malloc_brk;
ulong new = old + increment;
+ if ((new < mem_malloc_start) || (new > mem_malloc_end))
+ return (void *)MORECORE_FAILURE;
+
/*
* if we are giving memory back make sure we clear it out since
* we set MORECORE_CLEARS to 1
@@ -598,9 +601,6 @@ void *sbrk(ptrdiff_t increment)
if (increment < 0)
memset((void *)new, 0, -increment);
- if ((new < mem_malloc_start) || (new > mem_malloc_end))
- return (void *)MORECORE_FAILURE;
-
mem_malloc_brk = new;
return (void *)old;
--
2.34.1

43
meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch Normal file
View File

@@ -0,0 +1,43 @@
From db7c626204f488a802a2e58b7a788b11fde6be7d Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Fri, 2 Aug 2024 12:08:44 +0200
Subject: [PATCH 6/8] dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.
Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
CVE: CVE-2024-57258
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
common/dlmalloc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index bae2a27c..1ac4ee9f 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -379,8 +379,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/* pad request bytes into a usable size */
#define request2size(req) \
- (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
- (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
+ ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
+ (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
(((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK)))
/* Check if m has acceptable alignment */
--
2.34.1

40
meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch Normal file
View File

@@ -0,0 +1,40 @@
From 37095a204127b60b5e00c4c5d435d6e48a6a1c51 Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Fri, 2 Aug 2024 12:08:43 +0200
Subject: [PATCH 7/8] x86: Fix ptrdiff_t for x86_64
sbrk() assumes ptrdiff_t is large enough to enlarge/shrink the heap
by LONG_MIN/LONG_MAX.
So, use the long type, also to match the rest of the Linux ecosystem.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
CVE: CVE-2024-57258
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
arch/x86/include/asm/posix_types.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/posix_types.h b/arch/x86/include/asm/posix_types.h
index dbcea7f4..e1ed9bca 100644
--- a/arch/x86/include/asm/posix_types.h
+++ b/arch/x86/include/asm/posix_types.h
@@ -20,11 +20,12 @@ typedef unsigned short __kernel_gid_t;
#if defined(__x86_64__)
typedef unsigned long __kernel_size_t;
typedef long __kernel_ssize_t;
+typedef long __kernel_ptrdiff_t;
#else
typedef unsigned int __kernel_size_t;
typedef int __kernel_ssize_t;
-#endif
typedef int __kernel_ptrdiff_t;
+#endif
typedef long __kernel_time_t;
typedef long __kernel_suseconds_t;
typedef long __kernel_clock_t;
--
2.34.1

3
meta/recipes-bsp/u-boot/u-boot_2022.01.bb
View File

@@ -15,6 +15,9 @@ SRC_URI += " file://0001-riscv32-Use-double-float-ABI-for-rv32.patch \
file://CVE-2024-57255.patch \
file://CVE-2024-57256.patch \
file://CVE-2024-57257.patch \
file://CVE-2024-57258-1.patch \
file://CVE-2024-57258-2.patch \
file://CVE-2024-57258-3.patch \
"
DEPENDS += "bc-native dtc-native python3-setuptools-native"