Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (e321b1381031bdd83d8a322cf2e24364fef8a734)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (e321b1381031bdd83d8a322cf2e24364fef8a734)
  • Date: Wed, 13 May 2015 10:38:39 -0500

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

utils/xen/DETAILS | 6 +-
utils/xen/HISTORY | 7 ++
utils/xen/PRE_BUILD | 13 +++++
utils/xen/xsa133-qemut.patch | 80 +++++++++++++++++++++++++++++++++
utils/xen/xsa133-qemuu-4.3-4.2.patch | 84
+++++++++++++++++++++++++++++++++++
utils/xen/xsa133-qemuu.patch | 84
+++++++++++++++++++++++++++++++++++
6 files changed, 270 insertions(+), 4 deletions(-)

New commits:
commit e321b1381031bdd83d8a322cf2e24364fef8a734
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

xen: => 4.4.2 [security]

diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index 7b7f28c..007ccc9 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,10 +1,10 @@
SPELL=xen
if [[ $XEN_BRANCH == "4.2" ]]; then
VERSION=4.2.5
- SECURITY_PATCH=1
+ SECURITY_PATCH=2
else
- VERSION=4.4.0
- SECURITY_PATCH=9
+ VERSION=4.4.2
+ SECURITY_PATCH=10
fi
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index bab5e0e..98740d2 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,3 +1,10 @@
+2015-05-13 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 4.4.2 (4.4); SECURITY_PATCH++ for both
+ fixing VENOM (CVE-2015-3456); quoting paths
+ * PRE_BUILD: apply patches
+ * xsa133-qemut.patch, xsa133-qemuu-4.3-4.2.patch, xsa133-qemuu.patch:
+ added official patches, to fix VENOM vulnerability
+
2015-02-11 Vlad Glagolev <stealth AT sourcemage.org>
* DEPENDS: UDEV -> DEVICE-MANAGER

diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index 766d895..a2fc006 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -1,5 +1,16 @@
default_pre_build &&
-cd ${SOURCE_DIRECTORY} &&
+cd "${SOURCE_DIRECTORY}/tools/qemu-xen-traditional" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa133-qemut.patch" &&
+
+cd "${SOURCE_DIRECTORY}/tools/qemu-xen" &&
+
+if [[ $XEN_BRANCH == "4.2" ]]; then
+ patch -p1 < "$SPELL_DIRECTORY/xsa133-qemuu-4.3-4.2.patch"
+else
+ patch -p1 < "$SPELL_DIRECTORY/xsa133-qemuu.patch"
+fi &&
+
+cd "${SOURCE_DIRECTORY}" &&

patch -p0 < "$SPELL_DIRECTORY/prefix.patch" &&

diff --git a/utils/xen/xsa133-qemut.patch b/utils/xen/xsa133-qemut.patch
new file mode 100644
index 0000000..e1b7711
--- /dev/null
+++ b/utils/xen/xsa133-qemut.patch
@@ -0,0 +1,80 @@
+From ac7ddbe342d7aa2303c39ca731cc6229dbbd739b Mon Sep 17 00:00:00 2001
+From: Petr Matousek <pmatouse AT redhat.com>
+Date: Wed, 6 May 2015 09:48:59 +0200
+Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated
buffer
+
+During processing of certain commands such as FD_CMD_READ_ID and
+FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
+get out of bounds leading to memory corruption with values coming
+from the guest.
+
+Fix this by making sure that the index is always bounded by the
+allocated memory.
+
+This is CVE-2015-3456.
+
+Signed-off-by: Petr Matousek <pmatouse AT redhat.com>
+Reviewed-by: John Snow <jsnow AT redhat.com>
+---
+ hw/fdc.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/hw/fdc.c b/hw/fdc.c
+index b00a4ec..aba02e4 100644
+--- a/hw/fdc.c
++++ b/hw/fdc.c
+@@ -1318,7 +1318,7 @@ static uint32_t fdctrl_read_data (fdctrl_t *fdctrl)
+ {
+ fdrive_t *cur_drv;
+ uint32_t retval = 0;
+- int pos;
++ uint32_t pos;
+
+ cur_drv = get_cur_drv(fdctrl);
+ fdctrl->dsr &= ~FD_DSR_PWRDOWN;
+@@ -1327,8 +1327,8 @@ static uint32_t fdctrl_read_data (fdctrl_t *fdctrl)
+ return 0;
+ }
+ pos = fdctrl->data_pos;
++ pos %= FD_SECTOR_LEN;
+ if (fdctrl->msr & FD_MSR_NONDMA) {
+- pos %= FD_SECTOR_LEN;
+ if (pos == 0) {
+ if (fdctrl->data_pos != 0)
+ if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
+@@ -1673,10 +1673,13 @@ static void fdctrl_handle_option (fdctrl_t *fdctrl,
int direction)
+ static void fdctrl_handle_drive_specification_command (fdctrl_t *fdctrl,
int direction)
+ {
+ fdrive_t *cur_drv = get_cur_drv(fdctrl);
++ uint32_t pos;
+
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
++ pos = fdctrl->data_pos - 1;
++ pos %= FD_SECTOR_LEN;
++ if (fdctrl->fifo[pos] & 0x80) {
+ /* Command parameters done */
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
++ if (fdctrl->fifo[pos] & 0x40) {
+ fdctrl->fifo[0] = fdctrl->fifo[1];
+ fdctrl->fifo[2] = 0;
+ fdctrl->fifo[3] = 0;
+@@ -1771,7 +1774,7 @@ static uint8_t command_to_handler[256];
+ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
+ {
+ fdrive_t *cur_drv;
+- int pos;
++ uint32_t pos;
+
+ /* Reset mode */
+ if (!(fdctrl->dor & FD_DOR_nRESET)) {
+@@ -1817,7 +1820,9 @@ static void fdctrl_write_data (fdctrl_t *fdctrl,
uint32_t value)
+ }
+
+ FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
+- fdctrl->fifo[fdctrl->data_pos++] = value;
++ pos = fdctrl->data_pos++;
++ pos %= FD_SECTOR_LEN;
++ fdctrl->fifo[pos] = value;
+ if (fdctrl->data_pos == fdctrl->data_len) {
+ /* We now have all parameters
+ * and will be able to treat the command
diff --git a/utils/xen/xsa133-qemuu-4.3-4.2.patch
b/utils/xen/xsa133-qemuu-4.3-4.2.patch
new file mode 100644
index 0000000..688c7df
--- /dev/null
+++ b/utils/xen/xsa133-qemuu-4.3-4.2.patch
@@ -0,0 +1,84 @@
+From ac7ddbe342d7aa2303c39ca731cc6229dbbd739b Mon Sep 17 00:00:00 2001
+From: Petr Matousek <pmatouse AT redhat.com>
+Date: Wed, 6 May 2015 09:48:59 +0200
+Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated
buffer
+
+During processing of certain commands such as FD_CMD_READ_ID and
+FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
+get out of bounds leading to memory corruption with values coming
+from the guest.
+
+Fix this by making sure that the index is always bounded by the
+allocated memory.
+
+This is CVE-2015-3456.
+
+Signed-off-by: Petr Matousek <pmatouse AT redhat.com>
+Reviewed-by: John Snow <jsnow AT redhat.com>
+---
+ hw/fdc.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/hw/fdc.c b/hw/fdc.c
+index f72a392..d8a8edd 100644
+--- a/hw/fdc.c
++++ b/hw/fdc.c
+@@ -1497,7 +1497,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
+ {
+ FDrive *cur_drv;
+ uint32_t retval = 0;
+- int pos;
++ uint32_t pos;
+
+ cur_drv = get_cur_drv(fdctrl);
+ fdctrl->dsr &= ~FD_DSR_PWRDOWN;
+@@ -1506,8 +1506,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
+ return 0;
+ }
+ pos = fdctrl->data_pos;
++ pos %= FD_SECTOR_LEN;
+ if (fdctrl->msr & FD_MSR_NONDMA) {
+- pos %= FD_SECTOR_LEN;
+ if (pos == 0) {
+ if (fdctrl->data_pos != 0)
+ if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
+@@ -1852,10 +1852,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int
direction)
+ static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int
direction)
+ {
+ FDrive *cur_drv = get_cur_drv(fdctrl);
++ uint32_t pos;
+
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
++ pos = fdctrl->data_pos - 1;
++ pos %= FD_SECTOR_LEN;
++ if (fdctrl->fifo[pos] & 0x80) {
+ /* Command parameters done */
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
++ if (fdctrl->fifo[pos] & 0x40) {
+ fdctrl->fifo[0] = fdctrl->fifo[1];
+ fdctrl->fifo[2] = 0;
+ fdctrl->fifo[3] = 0;
+@@ -1955,7 +1958,7 @@ static uint8_t command_to_handler[256];
+ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
+ {
+ FDrive *cur_drv;
+- int pos;
++ uint32_t pos;
+
+ /* Reset mode */
+ if (!(fdctrl->dor & FD_DOR_nRESET)) {
+@@ -2004,7 +2007,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t
value)
+ }
+
+ FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
+- fdctrl->fifo[fdctrl->data_pos++] = value;
++ pos = fdctrl->data_pos++;
++ pos %= FD_SECTOR_LEN;
++ fdctrl->fifo[pos] = value;
+ if (fdctrl->data_pos == fdctrl->data_len) {
+ /* We now have all parameters
+ * and will be able to treat the command
+--
+2.1.0
+
+
diff --git a/utils/xen/xsa133-qemuu.patch b/utils/xen/xsa133-qemuu.patch
new file mode 100644
index 0000000..95f3dcc
--- /dev/null
+++ b/utils/xen/xsa133-qemuu.patch
@@ -0,0 +1,84 @@
+From ac7ddbe342d7aa2303c39ca731cc6229dbbd739b Mon Sep 17 00:00:00 2001
+From: Petr Matousek <pmatouse AT redhat.com>
+Date: Wed, 6 May 2015 09:48:59 +0200
+Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated
buffer
+
+During processing of certain commands such as FD_CMD_READ_ID and
+FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
+get out of bounds leading to memory corruption with values coming
+from the guest.
+
+Fix this by making sure that the index is always bounded by the
+allocated memory.
+
+This is CVE-2015-3456.
+
+Signed-off-by: Petr Matousek <pmatouse AT redhat.com>
+Reviewed-by: John Snow <jsnow AT redhat.com>
+---
+ hw/block/fdc.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/hw/block/fdc.c b/hw/block/fdc.c
+index f72a392..d8a8edd 100644
+--- a/hw/block/fdc.c
++++ b/hw/block/fdc.c
+@@ -1497,7 +1497,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
+ {
+ FDrive *cur_drv;
+ uint32_t retval = 0;
+- int pos;
++ uint32_t pos;
+
+ cur_drv = get_cur_drv(fdctrl);
+ fdctrl->dsr &= ~FD_DSR_PWRDOWN;
+@@ -1506,8 +1506,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
+ return 0;
+ }
+ pos = fdctrl->data_pos;
++ pos %= FD_SECTOR_LEN;
+ if (fdctrl->msr & FD_MSR_NONDMA) {
+- pos %= FD_SECTOR_LEN;
+ if (pos == 0) {
+ if (fdctrl->data_pos != 0)
+ if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
+@@ -1852,10 +1852,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int
direction)
+ static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int
direction)
+ {
+ FDrive *cur_drv = get_cur_drv(fdctrl);
++ uint32_t pos;
+
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
++ pos = fdctrl->data_pos - 1;
++ pos %= FD_SECTOR_LEN;
++ if (fdctrl->fifo[pos] & 0x80) {
+ /* Command parameters done */
+- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
++ if (fdctrl->fifo[pos] & 0x40) {
+ fdctrl->fifo[0] = fdctrl->fifo[1];
+ fdctrl->fifo[2] = 0;
+ fdctrl->fifo[3] = 0;
+@@ -1955,7 +1958,7 @@ static uint8_t command_to_handler[256];
+ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
+ {
+ FDrive *cur_drv;
+- int pos;
++ uint32_t pos;
+
+ /* Reset mode */
+ if (!(fdctrl->dor & FD_DOR_nRESET)) {
+@@ -2004,7 +2007,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t
value)
+ }
+
+ FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
+- fdctrl->fifo[fdctrl->data_pos++] = value;
++ pos = fdctrl->data_pos++;
++ pos %= FD_SECTOR_LEN;
++ fdctrl->fifo[pos] = value;
+ if (fdctrl->data_pos == fdctrl->data_len) {
+ /* We now have all parameters
+ * and will be able to treat the command
+--
+2.1.0
+
+



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (e321b1381031bdd83d8a322cf2e24364fef8a734), Vlad Glagolev, 05/13/2015

Archive powered by MHonArc 2.6.24.

Top of Page