All of lore.kernel.org
 help / color / mirror / Atom feed
From: Arturo Buzarra <arturo.buzarra@digi.com>
To: <openembedded-core@lists.openembedded.org>
Subject: [PATCH][daisy] bluez4: fix out-of-bounds access in SDP server (CVE-2017-1000250)
Date: Tue, 7 Nov 2017 14:36:51 +0100	[thread overview]
Message-ID: <20171107133651.24070-1-arturo.buzarra@digi.com> (raw)

Backport patch from bluez5 to bluez4

(From OE-Core rev: 8878d599cbc48b700f393d94657fe39db06fd533)

Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
---
 .../bluez/bluez4-4.101/cve-2017-1000250.patch      | 34 ++++++++++++++++++++++
 meta/recipes-connectivity/bluez/bluez4_4.101.bb    |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta/recipes-connectivity/bluez/bluez4-4.101/cve-2017-1000250.patch

diff --git a/meta/recipes-connectivity/bluez/bluez4-4.101/cve-2017-1000250.patch b/meta/recipes-connectivity/bluez/bluez4-4.101/cve-2017-1000250.patch
new file mode 100644
index 0000000000..4e1f02d588
--- /dev/null
+++ b/meta/recipes-connectivity/bluez/bluez4-4.101/cve-2017-1000250.patch
@@ -0,0 +1,34 @@
+All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an
+information disclosure vulnerability which allows remote attackers to obtain
+sensitive information from the bluetoothd process memory. This vulnerability
+lies in the processing of SDP search attribute requests.
+
+CVE: CVE-2017-1000250
+Upstream-Status: Backport
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+From 9e009647b14e810e06626dde7f1bb9ea3c375d09 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Wed, 13 Sep 2017 10:01:40 +0300
+Subject: sdp: Fix Out-of-bounds heap read in service_search_attr_req function
+
+Check if there is enough data to continue otherwise return an error.
+---
+ src/sdpd-request.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sdpd-request.c b/src/sdpd-request.c
+index 6a903c6..b2f9fbb 100644
+--- a/src/sdpd-request.c
++++ b/src/sdpd-request.c
+@@ -907,7 +907,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
+ 	} else {
+ 		/* continuation State exists -> get from cache */
+ 		sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);
+-		if (pCache) {
++		if (pCache && cstate->cStateValue.maxBytesSent < pCache->data_size) {
+ 			uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
+ 			pResponse = pCache->data;
+ 			memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
+-- 
+cgit v1.1
diff --git a/meta/recipes-connectivity/bluez/bluez4_4.101.bb b/meta/recipes-connectivity/bluez/bluez4_4.101.bb
index ccd230df8a..fc3c130fb7 100644
--- a/meta/recipes-connectivity/bluez/bluez4_4.101.bb
+++ b/meta/recipes-connectivity/bluez/bluez4_4.101.bb
@@ -9,6 +9,7 @@ SRC_URI += "file://bluetooth.conf \
             file://network-fix-network-Connect-method-parameters.patch \
             file://install-test-script.patch \
             file://use-legacy-pygobject-instead-ofgobject-introspection.patch \
+            file://cve-2017-1000250.patch \
 "
 
 SRC_URI[md5sum] = "fb42cb7038c380eb0e2fa208987c96ad"
-- 
2.15.0



                 reply	other threads:[~2017-11-07 13:39 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171107133651.24070-1-arturo.buzarra@digi.com \
    --to=arturo.buzarra@digi.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.