francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 15a46d72515c04d0eeaca19bf0356a39efc9cf93 Mon Sep 17 00:00:00 2001
|
|
From: Tom Rini <trini@konsulko.com>
|
|
Date: Tue, 9 Dec 2025 15:23:01 -0600
|
|
Subject: [PATCH] fs: fat: Perform sanity checks on getsize in get_fatent()
|
|
|
|
We do not perform a check on the value of getsize in get_fatent to
|
|
ensure that it will fit within the allocated buffer. For safety sake,
|
|
add a check now and if the value exceeds FATBUFBLOCKS use that value
|
|
instead. While not currently actively exploitable, it was in the past so
|
|
adding this check is worthwhile.
|
|
|
|
This addresses CVE-2025-24857 and was originally reported by Harvey
|
|
Phillips of Amazon Element55.
|
|
|
|
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
|
|
CVE: CVE-2025-24857
|
|
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2]
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
|
---
|
|
fs/fat/fat.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/fs/fat/fat.c b/fs/fat/fat.c
|
|
index e2570e81676..f6dc7ed15fe 100644
|
|
--- a/fs/fat/fat.c
|
|
+++ b/fs/fat/fat.c
|
|
@@ -215,6 +215,11 @@ static __u32 get_fatent(fsdata *mydata, __u32 entry)
|
|
if (flush_dirty_fat_buffer(mydata) < 0)
|
|
return -1;
|
|
|
|
+ if (getsize > FATBUFBLOCKS) {
|
|
+ debug("getsize is too large for bufptr\n");
|
|
+ getsize = FATBUFBLOCKS;
|
|
+ }
|
|
+
|
|
if (disk_read(startblock, getsize, bufptr) < 0) {
|
|
debug("Error reading FAT blocks\n");
|
|
return ret;
|
|
--
|
|
2.49.0
|
|
|