A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug
is triggered within the decode_deliver_report() function during the SMS decoding.
It is assumed that the attack scenario is accessible from a compromised modem,
a malicious base station, or just SMS. There is a bound check for this memcpy
length in decode_submit(), but it was forgotten in decode_deliver_report().
(From OE-Core rev: 3a3519324ec390044ff9f97c0f32027782699124)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug
is triggered within the decode_status_report() function during the SMS decoding.
It is assumed that the attack scenario is accessible from a compromised modem,
a malicious base station, or just SMS. There is a bound check for this memcpy
length in decode_submit(), but it was forgotten in decode_status_report().
(From OE-Core rev: 02005c81a55930d9f57d44674cdc5eb6171c8c76)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation
Vulnerability. This vulnerability allows local attackers to execute
arbitrary code on affected installations of oFono. An attacker must
first obtain the ability to execute code on the target modem in
order to exploit this vulnerability.
The specific flaw exists within the parsing of SMS PDUs. The issue
results from the lack of proper validation of the length of user-
supplied data prior to copying it to a stack-based buffer. An
attacker can leverage this vulnerability to execute code in the
context of the service account. Was ZDI-CAN-23460.
Reference:
https://security-tracker.debian.org/tracker/CVE-2024-7547
Upstream patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0
(From OE-Core rev: 8c32d91b64ae296d7832ddeb42983f4f3c237946)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation
Vulnerability. This vulnerability allows local attackers to execute
arbitrary code on affected installations of oFono. An attacker must
first obtain the ability to execute code on the target modem in
order to exploit this vulnerability.
The specific flaw exists within the parsing of STK command PDUs.
The issue results from the lack of proper validation of the length
of user-supplied data prior to copying it to a heap-based buffer.
An attacker can leverage this vulnerability to execute code in the
context of the service account. Was ZDI-CAN-23459.
Reference:
https://security-tracker.debian.org/tracker/CVE-2024-7546
Upstream patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63
(From OE-Core rev: 33b2a67b3134498e8c4845efddc7854b4d2315cd)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation
Vulnerability. This vulnerability allows local attackers to execute
arbitrary code on affected installations of oFono. An attacker must
first obtain the ability to execute code on the target modem in
order to exploit this vulnerability.
The specific flaw exists within the parsing of STK command PDUs.
The issue results from the lack of proper validation of the length
of user-supplied data prior to copying it to a heap-based buffer.
An attacker can leverage this vulnerability to execute code in the
context of the service account. Was ZDI-CAN-23458.
Reeference:
https://security-tracker.debian.org/tracker/CVE-2024-7545
Upstream patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5
(From OE-Core rev: f062d2e4ad3d0a35a2dadda679632d5d213b8487)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation
Vulnerability. This vulnerability allows local attackers to execute
arbitrary code on affected installations of oFono. An attacker must
first obtain the ability to execute code on the target modem in
order to exploit this vulnerability.
The specific flaw exists within the parsing of STK command PDUs.
The issue results from the lack of proper validation of the length
of user-supplied data prior to copying it to a heap-based buffer.
An attacker can leverage this vulnerability to execute code in the
context of the service account. Was ZDI-CAN-23457.
Reference:
https://security-tracker.debian.org/tracker/CVE-2024-7544
Upstream patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a
(From OE-Core rev: c4e7d6fad2ed96296bcea2b7d12b41e1354eafa8)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation
Vulnerability. This vulnerability allows local attackers to execute
arbitrary code on affected installations of oFono. An attacker must
first obtain the ability to execute code on the target modem in
order to exploit this vulnerability.
The specific flaw exists within the parsing of STK command PDUs.
The issue results from the lack of proper validation of the length
of user-supplied data prior to copying it to a heap-based buffer.
An attacker can leverage this vulnerability to execute code in the
context of the service account. Was ZDI-CAN-23456.
Reference:
https://security-tracker.debian.org/tracker/CVE-2024-7543
Upstream patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7
(From OE-Core rev: 31ba25646b78d60923b1d897a43e37ef6f9edd51)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability.
This vulnerability allows local attackers to execute arbitrary code
on affected installations of oFono. An attacker must first obtain
the ability to execute code on the target modem in order to exploit
this vulnerability.
The specific flaw exists within the parsing of responses from AT+CUSD
commands. The issue results from the lack of proper validation of the
length of user-supplied data prior to copying it to a stack-based buffer.
An attacker can leverage this vulnerability to execute code in the
context of root. Was ZDI-CAN-23195.
Reference:
https://security-tracker.debian.org/tracker/CVE-2024-7539
Upstream Patch:
https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc
(From OE-Core rev: b1626a0df6911172adafa85a99d36486eb7e2c62)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug
is triggered within the sms_decode_address_field() function during the SMS
PDU decoding. It is assumed that the attack scenario is accessible from a compromised
modem, a malicious base station, or just SMS.
(From OE-Core rev: 996c03dfb5295ec38286dee37c70c700b88e0a1e)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug
is triggered within the decode_submit_report() function during the SMS decoding.
It is assumed that the attack scenario is accessible from a compromised modem,
a malicious base station, or just SMS. There is a bound check for this memcpy
length in decode_submit(), but it was forgotten in decode_submit_report().
(From OE-Core rev: 51cf006ac7b5b97e65864fb1cb6f5b47192c4ebf)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Repo-wide replacement to use newer variable to represent systemd
system unitdir directory.
(From OE-Core rev: 5ace3ada5c54500c71becc8e0c6eddeb8bc053e3)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* -I../ofono-1.31 is included when building drivers/mbimmodem/mbim.c and then
ell.h will happily include ell/util.h from there:
# 1 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/ell/ell.h" 1 3 4
# 23 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/ell/ell.h" 3 4
# 1 "../ofono-1.31/ell/util.h" 1 3 4
# 26 "../ofono-1.31/ell/util.h" 3 4
# 1 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/string.h" 1 3 4
# 26 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/string.h" 3 4
# 1 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/bits/libc-header-start.h" 1 3 4
# 27 "/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/ofono/1.31-r0/recipe-sysroot/usr/include/string.h" 2 3 4
* and it gets more interesting because unlikely() macro was dropped from ell/util.h in:
https://git.kernel.org/pub/scm/libs/ell/ell.git/commit/?id=2a682421b06e41c45098217a686157f576847021
and ofono builds from git (which doesn't bundle ell) were failing with:
drivers/mbimmodem/mbim-message.c: In function 'message_iter_next_entry_valist':
drivers/mbimmodem/mbim-message.c:504:8: warning: implicit declaration of function 'unlikely' [-Wimplicit-function-declaration]
504 | if (unlikely(indent > MAX_NESTING))
| ^~~~~~~~
...
x86_64-webos-linux-libtool: link: x86_64-webos-linux-gcc -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot -I/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot/usr/include/dbus-1.0 -I/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot/usr/lib/dbus-1.0/include -I/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot/usr/include/glib-2.0 -I/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot/usr/lib/glib-2.0/include -DOFONO_PLUGIN_BUILTIN -DPLUGINDIR=\"/usr/lib/ofono/plugins\" -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0=/usr/src/debug/ofono/1.31+gitAUTOINC+0db662bd6b-r0 -fdebug-prefix-map=/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0=/usr/src/debug/ofono/1.31+gitAUTOINC+0db662bd6b-r0 -fdebug-prefix-map=/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot= -fdebug-prefix-map=/OE/build/luneos-honister/webos-ports/tmp-glibc/work/core2-64-webos-linux/ofono/1.31+gitAUTOINC+0db662bd6b-r0/recipe-sysroot-native= -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -o unit/test-mbim unit/test-mbim.o drivers/mbimmodem/mbim-message.o drivers/mbimmodem/mbim.o -lell
drivers/mbimmodem/mbim-message.c:1389: error: undefined reference to 'unlikely'
drivers/mbimmodem/mbim-message.c:1255: error: undefined reference to 'unlikely'
drivers/mbimmodem/mbim-message.c:514: error: undefined reference to 'unlikely'
drivers/mbimmodem/mbim-message.c:504: error: undefined reference to 'unlikely'
collect2: error: ld returned 1 exit status
while build from 1.31 tarball was passing OK, because using this older
bundled ell/util.h
delete bundled ell as we always enable external ell to make sure this
doesn't happen again and fix mbimmodem to build with ell-0.39
(From OE-Core rev: 25f44ce327aff94c956d431c3cdf92adc39b2eeb)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- remove the inc file
- run oe-stylize on the recipe
(From OE-Core rev: 3bfec923cf717bd1082beb0e026567951c2e99c0)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bluez4 was removed from meta-oe 2 years ago.
Simplfy the setup of the two level bluetooth and bluez4/bluez5
distro features by removing the bluez4/bluez5 distro features.
This also removes the no longer required bluetooth class.
(From OE-Core rev: dcf889e93401f7c4de0055d53271eacc3882eccc)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes build with musl where TEMP_FAILURE_RETRY is not provided
(From OE-Core rev: 2a6c1c33bcf061f65da159d66fae78b31bcc9e60)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of using a sed to fix the hashbang in a test tool send a patch upstream
and use that. This way we'll notice when the patch doesn't need to be applied
anymore.
(From OE-Core rev: 8b6c45dfdd6a7b469f5a0dd7308b25bdd4b1bf56)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In ver 1.22:
Fix issue with GPIO handling and Nokia modems.
Fix issue with SIM state callback and AT modems.
Fix issue with data mode and DCD for U-Blox modems.
Fix issue with SMS receive on QMI based Quectel EC21.
Fix issue with HFP support and last call dialed request.
Fix issue with PIM retires handling and Gemalto modems.
Fix issue with atom registration and SIM state handling.
Add support for handling SIM card AID session management.
Add support for handling GSM/UMTS and IMS authentication.
Add support for IP Multimedia Subsystem (IMS) atom.
Add support for MBIM based modems.
(From OE-Core rev: 7f96371566d00d44abf5cbfa012dd11dfa47187d)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
uclibc support was removed a while ago and musl works much better. Start to
remove the various overrides and patches related to uclibc which are no longer
needed.
uclibc support in a layer would still be possible. I have strong reasons to
believe nobody is still using uclibc since patches are missing and I doubt
the metadata even parses anymore.
(From OE-Core rev: 653704e9cf325cb494eb23facca19e9f05132ffd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Similar to gstreamer _git recipes, this recipe wasn't kept upto date
or tested regularly.
(From OE-Core rev: 9348ab34de2fe2ab04c8b84011809045c632fd87)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In particular, this fixes a crash on shutdown.
From upstream's ChangeLog:
ver 1.19:
Fix issue with DHCP parsing and Huawei modems.
Fix issue with detecting Huawei E3372 modem.
Fix issue with handling serving cell info.
Fix issue with handling SIM SC facility lock.
Fix issue with Android RIL PIN retry logic.
Fix issue with Android RIL and RAT handling.
Add support for Android RIL cell broadcast.
Add support for SoFIA 3GR thermal management.
(From OE-Core rev: a09810ef738ea1d2d643deeb255c8e6dd01ef306)
Signed-off-by: André Draszik <adraszik@tycoint.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It doesn't have files in udev dir, and bitbake.conf already sets it.
(From OE-Core rev: 10dbf13c86ce7f10ff84547fee8c4c5f15fe91fb)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- kernel-module-tun is needed so that ofono can create the
ppp network interface
- mobile-broadband-provider-info is needed as an explicit
dependency even though it is in DEPENDS, because it's
just an xml database, and the DEPENDS simply allows
ofono to figure out its location in the file system
(using pkg-config during configure). But there is no
shared library dependency or so for bitbake to figure
out this runtime dependency.
We make it a recommendation only, so that it can still
be removed from filesystem images in case people build
images that don't need the provider database (and e.g.
hard-code APNs for specific use-cases)
(From OE-Core rev: 1cb0eb9a013ad8a4092f610faeab2ee2720b9e66)
Signed-off-by: André Draszik <git@andred.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removed the patch 0001-backtrace-Disable-for-non-glibc-C-libraries.patch,
as it is included in the new sources.
(From OE-Core rev: 4ffa6d6950f23afa549116ff2bfb30e687888914)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It uses glibc backtrace() API which is not implemented
everywhere e.g. musl
Change-Id: I96380b994c27968542dba6dae220adfecaeda556
(From OE-Core rev: 4dd6bca8cdf538a7da9ffcb36faf70c3436b4f19)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Fix issue with PIN retry handling;
- Fix issue with HFP and multiple calls;
- Add support for Distracted Driving Reduction;
- Add support for available technologies property;
- Add support for Telit location reporting driver;
- Add support for u-blox SARA-U270 modems;
- Add support for Quectel UC15 modems.
(From OE-Core rev: b3e7ecc75f5a2b0cf6dde03fb7b2972e89457c0d)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For clarity use PACKAGECONFIG for the systemd and bluetooth optional features.
(From OE-Core rev: e76e7bf166544c1059c20753165a644dc1af750f)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
