From: Tom Rini <trini@konsulko.com>
To: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: u-boot@lists.denx.de,
Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
Joao Marcos Costa <joaomarcos.costa@bootlin.com>,
Jincheng Wang <jc.w4ng@gmail.com>
Subject: Re: [PATCH v2] fs/squashfs: sqfs_read: Prevent arbitrary code execution
Date: Fri, 17 Jun 2022 09:17:05 -0400 [thread overview]
Message-ID: <20220617131705.GO2484912@bill-the-cat> (raw)
In-Reply-To: <20220609140206.297405-1-miquel.raynal@bootlin.com>
[-- Attachment #1: Type: text/plain, Size: 917 bytes --]
On Thu, Jun 09, 2022 at 04:02:06PM +0200, Miquel Raynal wrote:
> Following Jincheng's report, an out-of-band write leading to arbitrary
> code execution is possible because on one side the squashfs logic
> accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> accepts directory names up to 255 bytes long.
>
> Prevent such an exploit from happening by capping directory name sizes
> to 255. Use a define for this purpose so that developers can link the
> limitation to its source and eventually kill it some day by dynamically
> allocating this array (if ever desired).
>
> Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
> Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> Tested-by: Jincheng Wang <jc.w4ng@gmail.com>
Applied to u-boot/master, thanks!
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
prev parent reply other threads:[~2022-06-17 13:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-09 14:02 [PATCH v2] fs/squashfs: sqfs_read: Prevent arbitrary code execution Miquel Raynal
2022-06-10 2:17 ` Jincheng Wang
2022-06-17 13:17 ` Tom Rini [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220617131705.GO2484912@bill-the-cat \
--to=trini@konsulko.com \
--cc=jc.w4ng@gmail.com \
--cc=joaomarcos.costa@bootlin.com \
--cc=miquel.raynal@bootlin.com \
--cc=thomas.petazzoni@bootlin.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.