debian-packaging
/
linux
8
0
Fork 0
Code Releases Activity

[x86] microcode/intel: Guard against stack overflow in the loader (CVE-2015-2666) 

svn path=/dists/sid/linux/; revision=22474
This commit is contained in:
Ben Hutchings 2015-04-06 17:31:57 +00:00
parent 999727f3c9
commit 6bc904578f
3 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/changelog vendored
View File

@ -184,6 +184,8 @@ linux (3.16.7-ckt9-1) UNRELEASED; urgency=medium
* ext4: fix ZERO_RANGE bug hidden by flag aliasing
* ext4: fix accidental flag aliasing in ext4_map_blocks flags
* ext4: allocate entire range in zero range (CVE-2015-0275)
* [x86] microcode/intel: Guard against stack overflow in the loader
(CVE-2015-2666)
-- Ian Campbell <ijc@debian.org> Wed, 18 Mar 2015 21:07:15 +0000

32
debian/patches/bugfix/x86/x86-microcode-intel-guard-against-stack-overflow-in-.patch vendored Normal file
View File

@ -0,0 +1,32 @@
From: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Date: Tue, 3 Feb 2015 13:00:22 +0100
Subject: x86/microcode/intel: Guard against stack overflow in the loader
Origin: https://git.kernel.org/linus/f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
mc_saved_tmp is a static array allocated on the stack, we need to make
sure mc_saved_count stays within its bounds, otherwise we're overflowing
the stack in _save_mc(). A specially crafted microcode header could lead
to a kernel crash or potentially kernel execution.
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1422964824-22056-1-git-send-email-quentin.casasnovas@oracle.com
Signed-off-by: Borislav Petkov <bp@suse.de>
---
arch/x86/kernel/cpu/microcode/intel_early.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
index ec9df6f..5e109a3 100644
--- a/arch/x86/kernel/cpu/microcode/intel_early.c
+++ b/arch/x86/kernel/cpu/microcode/intel_early.c
@@ -321,7 +321,7 @@ get_matching_model_microcode(int cpu, unsigned long start,
unsigned int mc_saved_count = mc_saved_data->mc_saved_count;
int i;
- while (leftover) {
+ while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) {
mc_header = (struct microcode_header_intel *)ucode_ptr;
mc_size = get_totalsize(mc_header);

1
debian/patches/series vendored
View File

@ -560,3 +560,4 @@ bugfix/all/btrfs-make-xattr-replace-operations-atomic.patch
bugfix/all/ext4-fix-zero_range-bug-hidden-by-flag-aliasing.patch
bugfix/all/ext4-fix-accidental-flag-aliasing-in-ext4_map_blocks.patch
bugfix/all/ext4-allocate-entire-range-in-zero-range.patch
bugfix/x86/x86-microcode-intel-guard-against-stack-overflow-in-.patch