francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
57 lines
2.2 KiB
Diff
57 lines
2.2 KiB
Diff
From 1406fc918977bba4dac0af5e22e63a5553aa6aff Mon Sep 17 00:00:00 2001
|
|
From: Paul HENRYS <paul.henrys_ext@softathome.com>
|
|
Date: Thu, 9 Oct 2025 17:43:28 +0200
|
|
Subject: [PATCH] net: bootp: Prevent buffer overflow to avoid leaking the RAM
|
|
content
|
|
|
|
CVE-2024-42040 describes a possible buffer overflow when calling
|
|
bootp_process_vendor() in bootp_handler() since the total length
|
|
of the packet is passed to bootp_process_vendor() without being
|
|
reduced to len-(offsetof(struct bootp_hdr,bp_vend)+4).
|
|
|
|
The packet length is also checked against its minimum size to avoid
|
|
reading data from struct bootp_hdr outside of the packet length.
|
|
|
|
Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
|
|
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
|
|
|
|
CVE: CVE-2024-42040
|
|
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/81e5708cc2c865df606e49aed5415adb2a662171]
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
|
---
|
|
net/bootp.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/net/bootp.c b/net/bootp.c
|
|
index 68002909634..843180d296c 100644
|
|
--- a/net/bootp.c
|
|
+++ b/net/bootp.c
|
|
@@ -362,6 +362,14 @@ static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
|
|
debug("got BOOTP packet (src=%d, dst=%d, len=%d want_len=%zu)\n",
|
|
src, dest, len, sizeof(struct bootp_hdr));
|
|
|
|
+ /* Check the minimum size of a BOOTP packet is respected.
|
|
+ * A BOOTP packet is between 300 bytes and 576 bytes big
|
|
+ */
|
|
+ if (len < offsetof(struct bootp_hdr, bp_vend) + 64) {
|
|
+ printf("Error: got an invalid BOOTP packet (len=%u)\n", len);
|
|
+ return;
|
|
+ }
|
|
+
|
|
bp = (struct bootp_hdr *)pkt;
|
|
|
|
/* Filter out pkts we don't want */
|
|
@@ -379,7 +387,8 @@ static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
|
|
|
|
/* Retrieve extended information (we must parse the vendor area) */
|
|
if (net_read_u32((u32 *)&bp->bp_vend[0]) == htonl(BOOTP_VENDOR_MAGIC))
|
|
- bootp_process_vendor((uchar *)&bp->bp_vend[4], len);
|
|
+ bootp_process_vendor((uchar *)&bp->bp_vend[4], len -
|
|
+ (offsetof(struct bootp_hdr, bp_vend) + 4));
|
|
|
|
net_set_timeout_handler(0, (thand_f *)0);
|
|
bootstage_mark_name(BOOTSTAGE_ID_BOOTP_STOP, "bootp_stop");
|
|
--
|
|
2.49.0
|
|
|