From 3a69555f909b4124bae270c16b397e7873c2db7d Mon Sep 17 00:00:00 2001 From: Arne Fitzenreiter Date: Sat, 12 Sep 2020 09:38:10 +0200 Subject: [PATCH] kernel: add patch agains CVE-2020-14386 fixes #12483 Signed-off-by: Arne Fitzenreiter --- lfs/linux | 3 ++ ...t_packet_fix_overflow_in_tpacket_rcv.patch | 44 +++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch diff --git a/lfs/linux b/lfs/linux index 8bec961509..cb9942938b 100644 --- a/lfs/linux +++ b/lfs/linux @@ -144,6 +144,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-random_try_to_actively_add_entropy.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch + # Patch CVE-2020-14386 + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch + ifeq "$(KCFG)" "-multi" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch b/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch new file mode 100644 index 0000000000..a3eb3231fc --- /dev/null +++ b/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch @@ -0,0 +1,44 @@ +From: Arne Fitzenreiter + +patch based on acf69c946233259ab4d64f8869d4037a198c7f06 +From: Or Cohen +Subject: net/packet: fix overflow in tpacket_rcv + +Using tp_reserve to calculate netoff can overflow as +tp_reserve is unsigned int and netoff is unsigned short. + +This may lead to macoff receving a smaller value then +sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr +is set, an out-of-bounds write will occur when +calling virtio_net_hdr_from_skb. + +The bug is fixed by converting netoff to unsigned int +and checking if it exceeds USHRT_MAX. + +This addresses CVE-2020-14386 + + +diff -Naur linux-4.14.197.org/net/packet/af_packet.c linux-4.14.197/net/packet/af_packet.c +--- linux-4.14.197.org/net/packet/af_packet.c 2020-09-11 22:27:31.003458577 +0200 ++++ linux-4.14.197/net/packet/af_packet.c 2020-09-11 22:38:53.104021712 +0200 +@@ -2201,7 +2201,8 @@ + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec ts; + __u32 ts_status; +@@ -2264,6 +2265,10 @@ + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ po->stats.stats1.tp_drops++; ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && -- 2.39.5