diff options
Diffstat (limited to 'poky/meta/recipes-kernel')
8 files changed, 183 insertions, 32 deletions
diff --git a/poky/meta/recipes-kernel/blktrace/blktrace/CVE-2018-10689.patch b/poky/meta/recipes-kernel/blktrace/blktrace/CVE-2018-10689.patch new file mode 100644 index 000000000..7b58568d5 --- /dev/null +++ b/poky/meta/recipes-kernel/blktrace/blktrace/CVE-2018-10689.patch @@ -0,0 +1,150 @@ +From d61ff409cb4dda31386373d706ea0cfb1aaac5b7 Mon Sep 17 00:00:00 2001 +From: Jens Axboe <axboe@kernel.dk> +Date: Wed, 2 May 2018 10:24:17 -0600 +Subject: [PATCH] btt: make device/devno use PATH_MAX to avoid overflow + +Herbo Zhang reports: + +I found a bug in blktrace/btt/devmap.c. The code is just as follows: + +https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/tree/btt/devmap.c?id=8349ad2f2d19422a6241f94ea84d696b21de4757 + + struct devmap { + +struct list_head head; +char device[32], devno[32]; // #1 +}; + +LIST_HEAD(all_devmaps); + +static int dev_map_add(char *line) +{ +struct devmap *dmp; + +if (strstr(line, "Device") != NULL) +return 1; + +dmp = malloc(sizeof(struct devmap)); +if (sscanf(line, "%s %s", dmp->device, dmp->devno) != 2) { //#2 +free(dmp); +return 1; +} + +list_add_tail(&dmp->head, &all_devmaps); +return 0; +} + +int dev_map_read(char *fname) +{ +char line[256]; // #3 +FILE *fp = my_fopen(fname, "r"); + +if (!fp) { +perror(fname); +return 1; +} + +while (fscanf(fp, "%255[a-zA-Z0-9 :.,/_-]\n", line) == 1) { +if (dev_map_add(line)) +break; +} + +fclose(fp); +return 0; +} + + The line length is 256, but the dmp->device, dmp->devno max length +is only 32. We can put strings longer than 32 into dmp->device and +dmp->devno , and then they will be overflowed. + + we can trigger this bug just as follows: + + $ python -c "print 'A'*256" > ./test + $ btt -M ./test + + *** Error in btt': free(): invalid next size (fast): 0x000055ad7349b250 *** + ======= Backtrace: ========= + /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f7f158ce7e5] + /lib/x86_64-linux-gnu/libc.so.6(+0x7fe0a)[0x7f7f158d6e0a] + /lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7f7f158da98c] + btt(+0x32e0)[0x55ad7306f2e0] + btt(+0x2c5f)[0x55ad7306ec5f] + btt(+0x251f)[0x55ad7306e51f] + /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f7f15877830] + btt(+0x26b9)[0x55ad7306e6b9] + ======= Memory map: ======== + 55ad7306c000-55ad7307f000 r-xp 00000000 08:14 3698139 + /usr/bin/btt + 55ad7327e000-55ad7327f000 r--p 00012000 08:14 3698139 + /usr/bin/btt + 55ad7327f000-55ad73280000 rw-p 00013000 08:14 3698139 + /usr/bin/btt + 55ad73280000-55ad73285000 rw-p 00000000 00:00 0 + 55ad7349a000-55ad734bb000 rw-p 00000000 00:00 0 + [heap] + 7f7f10000000-7f7f10021000 rw-p 00000000 00:00 0 + 7f7f10021000-7f7f14000000 ---p 00000000 00:00 0 + 7f7f15640000-7f7f15656000 r-xp 00000000 08:14 14942237 + /lib/x86_64-linux-gnu/libgcc_s.so.1 + 7f7f15656000-7f7f15855000 ---p 00016000 08:14 14942237 + /lib/x86_64-linux-gnu/libgcc_s.so.1 + 7f7f15855000-7f7f15856000 r--p 00015000 08:14 14942237 + /lib/x86_64-linux-gnu/libgcc_s.so.1 + 7f7f15856000-7f7f15857000 rw-p 00016000 08:14 14942237 + /lib/x86_64-linux-gnu/libgcc_s.so.1 + 7f7f15857000-7f7f15a16000 r-xp 00000000 08:14 14948477 + /lib/x86_64-linux-gnu/libc-2.23.so + 7f7f15a16000-7f7f15c16000 ---p 001bf000 08:14 14948477 + /lib/x86_64-linux-gnu/libc-2.23.so + 7f7f15c16000-7f7f15c1a000 r--p 001bf000 08:14 14948477 + /lib/x86_64-linux-gnu/libc-2.23.so + 7f7f15c1a000-7f7f15c1c000 rw-p 001c3000 08:14 14948477 + /lib/x86_64-linux-gnu/libc-2.23.so + 7f7f15c1c000-7f7f15c20000 rw-p 00000000 00:00 0 + 7f7f15c20000-7f7f15c46000 r-xp 00000000 08:14 14948478 + /lib/x86_64-linux-gnu/ld-2.23.so + 7f7f15e16000-7f7f15e19000 rw-p 00000000 00:00 0 + 7f7f15e42000-7f7f15e45000 rw-p 00000000 00:00 0 + 7f7f15e45000-7f7f15e46000 r--p 00025000 08:14 14948478 + /lib/x86_64-linux-gnu/ld-2.23.so + 7f7f15e46000-7f7f15e47000 rw-p 00026000 08:14 14948478 + /lib/x86_64-linux-gnu/ld-2.23.so + 7f7f15e47000-7f7f15e48000 rw-p 00000000 00:00 0 + 7ffdebe5c000-7ffdebe7d000 rw-p 00000000 00:00 0 + [stack] + 7ffdebebc000-7ffdebebe000 r--p 00000000 00:00 0 + [vvar] + 7ffdebebe000-7ffdebec0000 r-xp 00000000 00:00 0 + [vdso] + ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 + [vsyscall] + [1] 6272 abort btt -M test + +Signed-off-by: Jens Axboe <axboe@kernel.dk> + +Upstream-Status: Backport +[https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7] + +CVE: CVE-2018-10689 + +Signed-off-by: Yi Zhao <yi.zhao@windriver.com> +--- + btt/devmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/btt/devmap.c b/btt/devmap.c +index 0553a9e..5fc1cb2 100644 +--- a/btt/devmap.c ++++ b/btt/devmap.c +@@ -23,7 +23,7 @@ + + struct devmap { + struct list_head head; +- char device[32], devno[32]; ++ char device[PATH_MAX], devno[PATH_MAX]; + }; + + LIST_HEAD(all_devmaps); +-- +2.7.4 + diff --git a/poky/meta/recipes-kernel/blktrace/blktrace_git.bb b/poky/meta/recipes-kernel/blktrace/blktrace_git.bb index 663de2ed5..2605ff916 100644 --- a/poky/meta/recipes-kernel/blktrace/blktrace_git.bb +++ b/poky/meta/recipes-kernel/blktrace/blktrace_git.bb @@ -11,6 +11,7 @@ PV = "1.2.0+git${SRCPV}" SRC_URI = "git://git.kernel.dk/blktrace.git \ file://ldflags.patch \ + file://CVE-2018-10689.patch \ " S = "${WORKDIR}/git" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.12.bb b/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.12.bb index cf6a733ce..a6a8b60e1 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.12.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.12.bb @@ -11,13 +11,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "7ba09f891939cbf2c58801a7a4a740365896d6ba" -SRCREV_meta ?= "367bd3633d5a661035f90f0b8daa38e97da1a587" +SRCREV_machine ?= "ef88c3326f62cec4b98340324ddbe7f7f7704fd5" +SRCREV_meta ?= "2ae65226f64ed5c888d60eef76b6249db678d060" SRC_URI = "git://git.yoctoproject.org/linux-yocto-4.12.git;branch=${KBRANCH};name=machine \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.12;destsuffix=${KMETA}" -LINUX_VERSION ?= "4.12.26" +LINUX_VERSION ?= "4.12.28" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb b/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb index 00671182d..d5b285e7b 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb @@ -11,13 +11,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "aeeb2d73f2a828a9c0b121b2aa3bb345009f5698" -SRCREV_meta ?= "94457657b8d621868672917d1c2631df4a4fadd8" +SRCREV_machine ?= "af1b926c9160b0dbf2bbe41b166a8a7b07191fd2" +SRCREV_meta ?= "c43c9e19a22367b48c0f62764c8555643d2a6844" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}" -LINUX_VERSION ?= "4.14.48" +LINUX_VERSION ?= "4.14.67" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" DEPENDS += "openssl-native util-linux-native" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.12.bb b/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.12.bb index 9d5e1582b..cb4ef3a65 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.12.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.12.bb @@ -4,13 +4,13 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc -LINUX_VERSION ?= "4.12.26" +LINUX_VERSION ?= "4.12.28" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_meta ?= "367bd3633d5a661035f90f0b8daa38e97da1a587" +SRCREV_machine ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_meta ?= "2ae65226f64ed5c888d60eef76b6249db678d060" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb b/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb index 58945f25d..c9e6e412b 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb @@ -4,7 +4,7 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc -LINUX_VERSION ?= "4.14.48" +LINUX_VERSION ?= "4.14.67" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" DEPENDS += "openssl-native util-linux-native" @@ -12,8 +12,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "9e246607d5c23f8bb3b8800734b1707766e0b2b9" -SRCREV_meta ?= "94457657b8d621868672917d1c2631df4a4fadd8" +SRCREV_machine ?= "74ecbeb03ebfc2b9a73a6554924b043b903295f5" +SRCREV_meta ?= "c43c9e19a22367b48c0f62764c8555643d2a6844" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto_4.12.bb b/poky/meta/recipes-kernel/linux/linux-yocto_4.12.bb index ac98ca85f..0aea05b83 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto_4.12.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto_4.12.bb @@ -11,22 +11,22 @@ KBRANCH_qemux86 ?= "standard/base" KBRANCH_qemux86-64 ?= "standard/base" KBRANCH_qemumips64 ?= "standard/mti-malta64" -SRCREV_machine_qemuarm ?= "86b02dd23be1e3b3449885b38ed1b876ebec31e8" -SRCREV_machine_qemuarm64 ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_machine_qemumips ?= "67b93101c52504fd5077166c70baa296190e6166" -SRCREV_machine_qemuppc ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_machine_qemux86 ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_machine_qemux86-64 ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_machine_qemumips64 ?= "38da8c72733da9619bbbddf14140204631faf488" -SRCREV_machine ?= "bd8f931e213614bc5fdc6aeaa132d273caa002af" -SRCREV_meta ?= "367bd3633d5a661035f90f0b8daa38e97da1a587" +SRCREV_machine_qemuarm ?= "b84ecefc243a6ed67d8b6020394963de1240a9f0" +SRCREV_machine_qemuarm64 ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_machine_qemumips ?= "15b1ab68f73fa60dd95a74c640e87e05fad1716d" +SRCREV_machine_qemuppc ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_machine_qemux86 ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_machine_qemux86-64 ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_machine_qemumips64 ?= "57a3f72a020fc84f2da5b0b4c5de4cdbc22b3284" +SRCREV_machine ?= "e562267bae5b518acca880c929fbbdf6be047e0a" +SRCREV_meta ?= "2ae65226f64ed5c888d60eef76b6249db678d060" SRC_URI = "git://git.yoctoproject.org/linux-yocto-4.12.git;name=machine;branch=${KBRANCH}; \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.12;destsuffix=${KMETA}" DEPENDS += "openssl-native util-linux-native" -LINUX_VERSION ?= "4.12.26" +LINUX_VERSION ?= "4.12.28" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/poky/meta/recipes-kernel/linux/linux-yocto_4.14.bb b/poky/meta/recipes-kernel/linux/linux-yocto_4.14.bb index 0449213d4..91a2845a7 100644 --- a/poky/meta/recipes-kernel/linux/linux-yocto_4.14.bb +++ b/poky/meta/recipes-kernel/linux/linux-yocto_4.14.bb @@ -11,20 +11,20 @@ KBRANCH_qemux86 ?= "v4.14/standard/base" KBRANCH_qemux86-64 ?= "v4.14/standard/base" KBRANCH_qemumips64 ?= "v4.14/standard/mti-malta64" -SRCREV_machine_qemuarm ?= "363723ef50c06df54e146c8fe78faa962e96a8c8" -SRCREV_machine_qemuarm64 ?= "798d15552a4d5d9355a300290ed6bf72106b7e96" -SRCREV_machine_qemumips ?= "6c2433d7c51c3e78b1be2c7d1fbfe840b13d04df" -SRCREV_machine_qemuppc ?= "c03babad17499489b20216576d608c94e7fddc5d" -SRCREV_machine_qemux86 ?= "65d1c849534179bbfa494f77947f8be615e9871a" -SRCREV_machine_qemux86-64 ?= "65d1c849534179bbfa494f77947f8be615e9871a" -SRCREV_machine_qemumips64 ?= "59f70381cbde371e41206b7902390ae78558c310" -SRCREV_machine ?= "65d1c849534179bbfa494f77947f8be615e9871a" -SRCREV_meta ?= "94457657b8d621868672917d1c2631df4a4fadd8" +SRCREV_machine_qemuarm ?= "93d58c0c59d1dcdba6ff76ef093de7de339414a8" +SRCREV_machine_qemuarm64 ?= "888066bc1b9cc5f596da8237cbf74417106e8f22" +SRCREV_machine_qemumips ?= "a9d862bb92707f39c0cf2b2cc6f1645e88a99eb9" +SRCREV_machine_qemuppc ?= "d8ced31602b65fb92487865502da595bd113a329" +SRCREV_machine_qemux86 ?= "084af9624d268ddf4fd65b2f9e8e50ca2f22e62b" +SRCREV_machine_qemux86-64 ?= "084af9624d268ddf4fd65b2f9e8e50ca2f22e62b" +SRCREV_machine_qemumips64 ?= "44e1719a8f4fe10e88c13b9ec6c1fa1d041efaed" +SRCREV_machine ?= "084af9624d268ddf4fd65b2f9e8e50ca2f22e62b" +SRCREV_meta ?= "c43c9e19a22367b48c0f62764c8555643d2a6844" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}" -LINUX_VERSION ?= "4.14.48" +LINUX_VERSION ?= "4.14.67" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" DEPENDS += "openssl-native util-linux-native" |
