openssl: fix CVE-2014-0195
http://www.openssl.org/news/secadv_20140605.txt DTLS invalid fragment vulnerability (CVE-2014-0195) A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. Only applications using OpenSSL as a DTLS client or server affected. (Patch borrowed from Fedora.) (From OE-Core rev: c707b3ea9e1fbff2c6a82670e4b1af2b4f53d5e2) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
ad2c79b0fd
commit
c5d81c3386
|
@ -0,0 +1,40 @@
|
|||
commit 208d54db20d58c9a5e45e856a0650caadd7d9612
|
||||
Author: Dr. Stephen Henson <steve@openssl.org>
|
||||
Date: Tue May 13 18:48:31 2014 +0100
|
||||
|
||||
Fix for CVE-2014-0195
|
||||
|
||||
A buffer overrun attack can be triggered by sending invalid DTLS fragments
|
||||
to an OpenSSL DTLS client or server. This is potentially exploitable to
|
||||
run arbitrary code on a vulnerable client or server.
|
||||
|
||||
Fixed by adding consistency check for DTLS fragments.
|
||||
|
||||
Thanks to Jüri Aedla for reporting this issue.
|
||||
|
||||
Patch borrowed from Fedora
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
|
||||
|
||||
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
|
||||
index 2e8cf68..07f67f8 100644
|
||||
--- a/ssl/d1_both.c
|
||||
+++ b/ssl/d1_both.c
|
||||
@@ -627,7 +627,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
|
||||
frag->msg_header.frag_off = 0;
|
||||
}
|
||||
else
|
||||
+ {
|
||||
frag = (hm_fragment*) item->data;
|
||||
+ if (frag->msg_header.msg_len != msg_hdr->msg_len)
|
||||
+ {
|
||||
+ item = NULL;
|
||||
+ frag = NULL;
|
||||
+ goto err;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
|
||||
/* If message is already reassembled, this must be a
|
||||
* retransmit and can be dropped.
|
||||
|
|
@ -39,6 +39,7 @@ SRC_URI += "file://configure-targets.patch \
|
|||
file://0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch \
|
||||
file://CVE-2014-0160.patch \
|
||||
file://openssl-CVE-2014-0198-fix.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0195.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c"
|
||||
|
|
Loading…
Reference in New Issue