| Message ID | 869863DB5440B44FB22173F42FC3F3CE01DAE731@dggemm513-mbx.china.huawei.com |
|---|---|
| State | Accepted |
| Commit | aa207cf3a6 |
| Delegated to: | Joe Hershberger |
| Headers | show |
| Series | [U-Boot,v2,1/5] CVE: net: fix unbounded memcpy of UDP packet//RE: [PATCH 1/5] CVE: net: fix unbounded memcpy of UDP packet | expand |
On Thu, Aug 29, 2019 at 8:50 AM liucheng (G) <liucheng32@huawei.com> wrote: > > Changes in v2: > - Add reported-by tag for patch 3/5 > -------------------------------------------------------------------------------------------------------------- > CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply > > This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply. > > Signed-off-by: Cheng Liu <liucheng32@huawei.com> > Reported-by: Fermín Serna <fermin@semmle.com> Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Hi liucheng, https://patchwork.ozlabs.org/patch/1155277/ was applied to http://git.denx.de/?p=u-boot/u-boot-net.git Thanks! -Joe
diff --git a/net/nfs.c b/net/nfs.c index b7cf3b3..11941fa 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -701,6 +701,9 @@ static int nfs_read_reply(uchar *pkt, unsigned len) &(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]); } + if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) + return -9999; + if (store_block(data_ptr, nfs_offset, rlen)) return -9999; -- 1.8.5.6 -----Original Message----- From: liucheng (G) Sent: Wednesday, August 21, 2019 10:48 PM To: u-boot@lists.denx.de Cc: liucheng (G) <liucheng32@huawei.com> Subject: [PATCH 3/5] CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply. Signed-off-by: Cheng Liu <liucheng32@huawei.com> --- net/nfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/nfs.c b/net/nfs.c index b7cf3b3..11941fa 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -701,6 +701,9 @@ static int nfs_read_reply(uchar *pkt, unsigned len) &(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]); } + if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) + return -9999; + if (store_block(data_ptr, nfs_offset, rlen)) return -9999;
Changes in v2: - Add reported-by tag for patch 3/5 -------------------------------------------------------------------------------------------------------------- CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply. Signed-off-by: Cheng Liu <liucheng32@huawei.com> Reported-by: Fermín Serna <fermin@semmle.com> --- net/nfs.c | 3 +++ 1 file changed, 3 insertions(+)