francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
52 lines
2.4 KiB
Diff
52 lines
2.4 KiB
Diff
From 586f01d74f23dabcd733c82a05cf26bf123a91dc Mon Sep 17 00:00:00 2001
|
|
From: Libo Chen <libo.chen.cn@windriver.com>
|
|
Date: Fri, 30 Jan 2026 11:42:10 +0800
|
|
Subject: [PATCH] Fix CVE-2025-2153
|
|
|
|
This PR fixes #5329. Previously, the message flags field was able to be modified such that a message that is not sharable according to the share_flags field in H5O_msg_class_t could be treated as sharable. A check has been added to make sure messages that are not sharable can't be modified so that they indicate they can be shared.
|
|
|
|
The bug was first reproduced using the fuzzer and the POC file from #5329. With this change, the heap based buffer overflow no longer occurs.
|
|
|
|
CVE: CVE-2025-2153
|
|
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/38954615fc079538aa45d48097625a6d76aceef0]
|
|
|
|
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
|
|
---
|
|
src/H5Ocache.c | 4 ++--
|
|
src/H5Omessage.c | 3 +++
|
|
2 files changed, 5 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/H5Ocache.c b/src/H5Ocache.c
|
|
index 9b82509..7203490 100644
|
|
--- a/src/H5Ocache.c
|
|
+++ b/src/H5Ocache.c
|
|
@@ -1422,8 +1422,8 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
|
|
else {
|
|
/* Check for message of unshareable class marked as "shareable"
|
|
*/
|
|
- if ((flags & H5O_MSG_FLAG_SHAREABLE) && H5O_msg_class_g[id] &&
|
|
- !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
|
|
+ if (((flags & H5O_MSG_FLAG_SHARED) || (flags & H5O_MSG_FLAG_SHAREABLE)) &&
|
|
+ H5O_msg_class_g[id] && !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL,
|
|
"message of unshareable class flagged as shareable");
|
|
|
|
diff --git a/src/H5Omessage.c b/src/H5Omessage.c
|
|
index 7190e46..fb9006c 100644
|
|
--- a/src/H5Omessage.c
|
|
+++ b/src/H5Omessage.c
|
|
@@ -354,6 +354,9 @@ H5O__msg_write_real(H5F_t *f, H5O_t *oh, const H5O_msg_class_t *type, unsigned m
|
|
*/
|
|
assert(!(mesg_flags & H5O_MSG_FLAG_DONTSHARE));
|
|
|
|
+ /* Sanity check to see if the type is not sharable */
|
|
+ assert(type->share_flags & H5O_SHARE_IS_SHARABLE);
|
|
+
|
|
/* Remove the old message from the SOHM index */
|
|
/* (It would be more efficient to try to share the message first, then
|
|
* delete it (avoiding thrashing the index in the case the ref.
|
|
--
|
|
2.34.1
|
|
|