mirror of
https://git.yoctoproject.org/poky
synced 2026-01-29 21:08:42 +01:00
ofono: Fix multiple CVEs
Backport fixes for: * CVE-2024-7539 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc * CVE-2024-7543 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7 * CVE-2024-7544 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a * CVE-2024-7545 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5 * CVE-2024-7546 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63 * CVE-2024-7547 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0 (From OE-Core rev: d244d4d48615a7b08f1ab0231f074caa31790247) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hitendra Prajapati
committed by
Steve Sakoman
Steve Sakoman
parent
b84adcd947
commit
a65e0b9646
88
meta/recipes-connectivity/ofono/ofono/CVE-2024-7539.patch
Normal file
88
meta/recipes-connectivity/ofono/ofono/CVE-2024-7539.patch
Normal file
@@ -0,0 +1,88 @@
|
||||
From 389e2344f86319265fb72ae590b470716e038fdc Mon Sep 17 00:00:00 2001
|
||||
From: "Sicelo A. Mhlongo" <absicsz@gmail.com>
|
||||
Date: Tue, 17 Dec 2024 11:31:29 +0200
|
||||
Subject: [PATCH] ussd: ensure ussd content fits in buffers
|
||||
|
||||
Fixes: CVE-2024-7539
|
||||
|
||||
CVE: CVE-2024-7539
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
drivers/atmodem/ussd.c | 5 ++++-
|
||||
drivers/huaweimodem/ussd.c | 5 ++++-
|
||||
drivers/speedupmodem/ussd.c | 5 ++++-
|
||||
3 files changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c
|
||||
index aaf47b2..cee9bc5 100644
|
||||
--- a/drivers/atmodem/ussd.c
|
||||
+++ b/drivers/atmodem/ussd.c
|
||||
@@ -107,7 +107,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
const char *content;
|
||||
int dcs;
|
||||
enum sms_charset charset;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -127,6 +127,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
if (!g_at_result_iter_next_number(&iter, &dcs))
|
||||
dcs = 0;
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
if (!cbs_dcs_decode(dcs, NULL, NULL, &charset, NULL, NULL, NULL)) {
|
||||
ofono_error("Unsupported USSD data coding scheme (%02x)", dcs);
|
||||
status = 4; /* Not supported */
|
||||
diff --git a/drivers/huaweimodem/ussd.c b/drivers/huaweimodem/ussd.c
|
||||
index ffb9b2a..cfdb4ee 100644
|
||||
--- a/drivers/huaweimodem/ussd.c
|
||||
+++ b/drivers/huaweimodem/ussd.c
|
||||
@@ -52,7 +52,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
int status;
|
||||
int dcs = 0;
|
||||
const char *content;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -69,6 +69,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
|
||||
g_at_result_iter_next_number(&iter, &dcs);
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
||||
|
||||
out:
|
||||
diff --git a/drivers/speedupmodem/ussd.c b/drivers/speedupmodem/ussd.c
|
||||
index 44da8ed..33441c6 100644
|
||||
--- a/drivers/speedupmodem/ussd.c
|
||||
+++ b/drivers/speedupmodem/ussd.c
|
||||
@@ -51,7 +51,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
int status;
|
||||
int dcs = 0;
|
||||
const char *content;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -68,6 +68,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
|
||||
g_at_result_iter_next_number(&iter, &dcs);
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
||||
|
||||
out:
|
||||
--
|
||||
2.25.1
|
||||
|
||||
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7543.patch
Normal file
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7543.patch
Normal file
@@ -0,0 +1,30 @@
|
||||
From 90e60ada012de42964214d8155260f5749d0dcc7 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:50 +0200
|
||||
Subject: [PATCH] stkutil: Fix CVE-2024-7543
|
||||
|
||||
CVE: CVE-2024-7543
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index 4f31af4..fdd11ad 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1876,6 +1876,10 @@ static bool parse_dataobj_mms_reference(struct comprehension_tlv_iter *iter,
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mr->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mr->ref))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mr->ref, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7544.patch
Normal file
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7544.patch
Normal file
@@ -0,0 +1,30 @@
|
||||
From a240705a0d5d41eca6de4125ab2349ecde4c873a Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:49 +0200
|
||||
Subject: [PATCH] stkutil: Fix CVE-2024-7544
|
||||
|
||||
CVE: CVE-2024-7544
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index fdd11ad..475caaa 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1898,6 +1898,10 @@ static bool parse_dataobj_mms_id(struct comprehension_tlv_iter *iter,
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mi->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mi->id))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mi->id, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
32
meta/recipes-connectivity/ofono/ofono/CVE-2024-7545.patch
Normal file
32
meta/recipes-connectivity/ofono/ofono/CVE-2024-7545.patch
Normal file
@@ -0,0 +1,32 @@
|
||||
From 556e14548c38c2b96d85881542046ee7ed750bb5 Mon Sep 17 00:00:00 2001
|
||||
From: Sicelo A. Mhlongo <absicsz@gmail.com>
|
||||
Date: Wed, Dec 4 12:07:34 2024 +0200
|
||||
Subject: [PATCH] stkutil: ensure data fits in buffer
|
||||
|
||||
Fixes CVE-2024-7545
|
||||
|
||||
CVE: CVE-2024-7545
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index 475caaa..e1fd75c 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1938,6 +1938,10 @@ static bool parse_dataobj_mms_content_id(
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mci->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mci->id))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mci->id, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7546.patch
Normal file
30
meta/recipes-connectivity/ofono/ofono/CVE-2024-7546.patch
Normal file
@@ -0,0 +1,30 @@
|
||||
From 79ea6677669e50b0bb9c231765adb4f81c375f63 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:52 +0200
|
||||
Subject: [PATCH] Fix CVE-2024-7546
|
||||
|
||||
CVE: CVE-2024-7546
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index e1fd75c..88a715d 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1783,6 +1783,10 @@ static bool parse_dataobj_frame_layout(struct comprehension_tlv_iter *iter,
|
||||
|
||||
fl->layout = data[0];
|
||||
fl->len = len - 1;
|
||||
+
|
||||
+ if (fl->len > sizeof(fl->size))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(fl->size, data + 1, fl->len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
29
meta/recipes-connectivity/ofono/ofono/CVE-2024-7547.patch
Normal file
29
meta/recipes-connectivity/ofono/ofono/CVE-2024-7547.patch
Normal file
@@ -0,0 +1,29 @@
|
||||
From 305df050d02aea8532f7625d6642685aa530f9b0 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:51 +0200
|
||||
Subject: [PATCH] Fix CVE-2024-7547
|
||||
|
||||
CVE: CVE-2024-7547
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/smsutil.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index def47e8..f79f59d 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1475,6 +1475,9 @@ static gboolean decode_command(const unsigned char *pdu, int len,
|
||||
if ((len - offset) < out->command.cdl)
|
||||
return FALSE;
|
||||
|
||||
+ if (out->command.cdl > sizeof(out->command.cd))
|
||||
+ return FALSE;
|
||||
+
|
||||
memcpy(out->command.cd, pdu + offset, out->command.cdl);
|
||||
|
||||
return TRUE;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -16,6 +16,12 @@ SRC_URI = "\
|
||||
file://CVE-2023-2794-0002.patch \
|
||||
file://CVE-2023-2794-0003.patch \
|
||||
file://CVE-2023-2794-0004.patch \
|
||||
file://CVE-2024-7539.patch \
|
||||
file://CVE-2024-7543.patch \
|
||||
file://CVE-2024-7544.patch \
|
||||
file://CVE-2024-7545.patch \
|
||||
file://CVE-2024-7546.patch \
|
||||
file://CVE-2024-7547.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "93580adc1afd1890dc516efb069de0c5cdfef014415256ddfb28ab172df2d11d"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user