mirror of
https://git.yoctoproject.org/poky
synced 2026-07-01 23:13:38 +02:00
e3072d229a
According to [1], Improper access control for volatile memory containing boot
code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019,
IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker
to execute arbitrary code.
Backport a patch [2] from upstream to fix CVE-2025-24857
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24857
[2] 87d85139a9
(From OE-Core rev: 6f69c878896b536f5f7b16c566d420e188c82c7f)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 15a46d72515c04d0eeaca19bf0356a39efc9cf93 Mon Sep 17 00:00:00 2001
|
|
From: Tom Rini <trini@konsulko.com>
|
|
Date: Tue, 9 Dec 2025 15:23:01 -0600
|
|
Subject: [PATCH] fs: fat: Perform sanity checks on getsize in get_fatent()
|
|
|
|
We do not perform a check on the value of getsize in get_fatent to
|
|
ensure that it will fit within the allocated buffer. For safety sake,
|
|
add a check now and if the value exceeds FATBUFBLOCKS use that value
|
|
instead. While not currently actively exploitable, it was in the past so
|
|
adding this check is worthwhile.
|
|
|
|
This addresses CVE-2025-24857 and was originally reported by Harvey
|
|
Phillips of Amazon Element55.
|
|
|
|
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
|
|
CVE: CVE-2025-24857
|
|
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2]
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
|
---
|
|
fs/fat/fat.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/fs/fat/fat.c b/fs/fat/fat.c
|
|
index e2570e81676..f6dc7ed15fe 100644
|
|
--- a/fs/fat/fat.c
|
|
+++ b/fs/fat/fat.c
|
|
@@ -215,6 +215,11 @@ static __u32 get_fatent(fsdata *mydata, __u32 entry)
|
|
if (flush_dirty_fat_buffer(mydata) < 0)
|
|
return -1;
|
|
|
|
+ if (getsize > FATBUFBLOCKS) {
|
|
+ debug("getsize is too large for bufptr\n");
|
|
+ getsize = FATBUFBLOCKS;
|
|
+ }
|
|
+
|
|
if (disk_read(startblock, getsize, bufptr) < 0) {
|
|
debug("Error reading FAT blocks\n");
|
|
return ret;
|
|
--
|
|
2.49.0
|
|
|