mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-11 11:13:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

elfutils: CVE-2014-9447

Browse Source 
directory traversal in read_long_names()

Reference
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9447

Upstream commit with the analysis:
https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e

(From OE-Core rev: 6e7badf6819f372bd6dced191c7fda9748062126)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Sona Sarmadi
2015-04-29 11:02:21 +02:00
committed by Richard Purdie
parent ccbb7ef72f
commit b9da1f441b
2 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
meta/recipes-devtools/elfutils/elfutils/CVE-2014-9447.patch Normal file
View File

@@ -0,0 +1,50 @@
libelf: Fix dir traversal vuln in ar extraction.
read_long_names terminates names at the first '/' found but then skips one
character without checking (it's supposed to be '\n'). Hence the next name could
start with any character including '/'. This leads to a directory traversal
vulnerability at the time the contents of the archive is extracted.
The danger is mitigated by the fact that only one '/' is possible in a resulting
filename
and only in the leading position. Hence only files in the root directory can be
written via this vuln and only when ar is executed as root. The fix for the vuln
is to not skip any characters while looking for '/'.
Upstream commit:
https://git.fedorahosted.org/cgit/elfutils.git/commit/
?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e
Fixes CVE-2014-9447
Upstream-Status: Backport
Signed-off-by: Alexander Cherepanov <cherepan@mccme.ru>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
diff -ruN a/libelf/ChangeLog b/libelf/ChangeLog
--- a/libelf/ChangeLog 2015-03-03 12:39:39.255277970 +0100
+++ b/libelf/ChangeLog 2015-03-03 12:43:44.700870042 +0100
@@ -1,3 +1,8 @@
+2014-12-28 Alexander Cherepanov <cherepan@mccme.ru>
+
+ * elf_begin.c (read_long_names): Don't miss '/' right after
+ another '/'. Fixes a dir traversal vuln in ar extraction.
+
2012-08-16 Roland McGrath <roland@hack.frob.com>
* elf.h: Update from glibc.
diff -ruN a/libelf/elf_begin.c b/libelf/elf_begin.c
--- a/libelf/elf_begin.c 2015-03-03 12:39:39.835253375 +0100
+++ b/libelf/elf_begin.c 2015-03-03 12:41:30.906543370 +0100
@@ -744,10 +744,7 @@
break;
/* NUL-terminate the string. */
- *runp = '\0';
-
- /* Skip the NUL byte and the \012. */
- runp += 2;
+ *runp++ = '\0';
/* A sanity check. Somebody might have generated invalid
archive. */

1
meta/recipes-devtools/elfutils/elfutils_0.155.bb
View File

@@ -23,6 +23,7 @@ SRC_URI += "\
file://nm-Fix-size-passed-to-snprintf-for-invalid-sh_name-case.patch \
file://elfutils-ar-c-fix-num-passed-to-memset.patch \
file://fix-build-gcc-4.8.patch \
file://CVE-2014-9447.patch \
"
# Only apply when building uclibc based target recipe
SRC_URI_append_libc-uclibc = " file://uclibc-support.patch"