diff options
Diffstat (limited to 'package/slirp')
| -rw-r--r-- | package/slirp/0001-slirp-check-pkt_len-before-reading-protocol-header.patch | 60 | ||||
| -rw-r--r-- | package/slirp/Config.in | 25 | ||||
| -rw-r--r-- | package/slirp/slirp.hash | 3 | ||||
| -rw-r--r-- | package/slirp/slirp.mk | 25 |
4 files changed, 90 insertions, 23 deletions
diff --git a/package/slirp/0001-slirp-check-pkt_len-before-reading-protocol-header.patch b/package/slirp/0001-slirp-check-pkt_len-before-reading-protocol-header.patch new file mode 100644 index 0000000000..4046144712 --- /dev/null +++ b/package/slirp/0001-slirp-check-pkt_len-before-reading-protocol-header.patch @@ -0,0 +1,60 @@ +From 2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Thu, 26 Nov 2020 19:27:06 +0530 +Subject: [PATCH] slirp: check pkt_len before reading protocol header +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input' +routines, ensure that pkt_len is large enough to accommodate the +respective protocol headers, lest it should do an OOB access. +Add check to avoid it. + +CVE-2020-29129 CVE-2020-29130 + QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets + -> https://www.openwall.com/lists/oss-security/2020/11/27/1 + +Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Message-Id: <20201126135706.273950-1-ppandit@redhat.com> +Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Signed-off-by: Peter Korsgaard <peter@korsgaard.com> +--- + src/ncsi.c | 4 ++++ + src/slirp.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/src/ncsi.c b/src/ncsi.c +index 3c1dfef..75dcc08 100644 +--- a/src/ncsi.c ++++ b/src/ncsi.c +@@ -148,6 +148,10 @@ void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len) + uint32_t checksum; + uint32_t *pchecksum; + ++ if (pkt_len < ETH_HLEN + sizeof(struct ncsi_pkt_hdr)) { ++ return; /* packet too short */ ++ } ++ + memset(ncsi_reply, 0, sizeof(ncsi_reply)); + + memset(reh->h_dest, 0xff, ETH_ALEN); +diff --git a/src/slirp.c b/src/slirp.c +index 9bead0c..abb6f9a 100644 +--- a/src/slirp.c ++++ b/src/slirp.c +@@ -860,6 +860,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len) + return; + } + ++ if (pkt_len < ETH_HLEN + sizeof(struct slirp_arphdr)) { ++ return; /* packet too short */ ++ } ++ + ar_op = ntohs(ah->ar_op); + switch (ar_op) { + case ARPOP_REQUEST: +-- +2.20.1 + diff --git a/package/slirp/Config.in b/package/slirp/Config.in index 51dea9700f..38fd5277af 100644 --- a/package/slirp/Config.in +++ b/package/slirp/Config.in @@ -1,16 +1,14 @@ config BR2_PACKAGE_SLIRP bool "slirp" + depends on BR2_USE_MMU # libglib2 + depends on BR2_USE_WCHAR # libglib2 + depends on BR2_TOOLCHAIN_HAS_THREADS # libglib2 + select BR2_PACKAGE_LIBGLIB2 help - The Spice project aims to provide a complete open source - solution for interaction with virtualized desktop devices. - The Spice project deals with both the virtualized devices - and the front-end. Interaction between front-end and - back-end is done using VD-Interfaces. + libslirp is a user-mode networking library used by virtual + machines, containers or various tools. - This package implements the slirp-part for Spice. Slirp - emulates a PPP or SLIP connection over a normal terminal. - - http://www.spice-space.org/ + https://gitlab.freedesktop.org/slirp/libslirp/ NOTE: This package has some history of a unique kind: @@ -21,5 +19,10 @@ config BR2_PACKAGE_SLIRP - during that period, QEMU (Fabrice BELLARD) forked the code and included it in QEMU - and it was imported from this breed by the Spice project - around May 2009 - - which is what we use here + around May 2009 which archived it in 2012 + - So we switched to + https://gitlab.freedesktop.org/slirp/libslirp + +comment "slirp needs a toolchain w/ wchar, threads" + depends on BR2_USE_MMU + depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS diff --git a/package/slirp/slirp.hash b/package/slirp/slirp.hash new file mode 100644 index 0000000000..fe295b3bfb --- /dev/null +++ b/package/slirp/slirp.hash @@ -0,0 +1,3 @@ +# Locally computed: +sha256 388b4b08a8cc0996cc5155cb027a097dc1a7f2cfe84b1121496608ab5366cc48 libslirp-4.3.1.tar.xz +sha256 b28aecf4796a6a22054167f0a976de13d9db335669d37afd2dc7ea4c335e1e13 COPYRIGHT diff --git a/package/slirp/slirp.mk b/package/slirp/slirp.mk index 7cfead65e2..ff92c60517 100644 --- a/package/slirp/slirp.mk +++ b/package/slirp/slirp.mk @@ -4,18 +4,19 @@ # ################################################################################ -# There's no tarball releases of slirp, so we use the git repo -# Also, there's no tag, so we use a random SHA1 (master's HEAD -# of today) -SLIRP_VERSION = 8c2da74c1385242f20799fec8c04f8378edc6550 -SLIRP_SITE = git://anongit.freedesktop.org/spice/slirp -SLIRP_LICENSE = BSD-4-Clause, BSD-2-Clause -# Note: The license file 'COPYRIGHT' is missing from the sources, -# although some files refer to it. +SLIRP_VERSION = 4.3.1 +SLIRP_SOURCE = libslirp-$(SLIRP_VERSION).tar.xz +# Other "official" tarballs don't ship .tarball-version resulting in a build +# failure: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/24 +SLIRP_SITE = https://elmarco.fedorapeople.org +SLIRP_LICENSE = BSD-3-Clause +SLIRP_LICENSE_FILES = COPYRIGHT +SLIRP_CPE_ID_VENDOR = libslirp_project +SLIRP_CPE_ID_PRODUCT = libslirp SLIRP_INSTALL_STAGING = YES +SLIRP_DEPENDENCIES = libglib2 -# As we're using the git tree, there's no ./configure, -# so we need to autoreconf. -SLIRP_AUTORECONF = YES +# 0001-slirp-check-pkt_len-before-reading-protocol-header.patch +SLIRP_IGNORE_CVES += CVE-2020-29129 CVE-2020-29130 -$(eval $(autotools-package)) +$(eval $(meson-package)) |