packages/arm-trusted-firmware
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE-2024-6285

Browse Source 
(cherry picked from commit f9342adcc82294ba2fd7809f49d601441a0998a7)
This commit is contained in:
wk333 2024-12-16 16:42:06 +08:00 committed by openeuler-sync-bot
parent 9e676fad5c
commit e53a77cecb
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
CVE-2024-6285.patch Normal file
View File

@ -0,0 +1,47 @@
From 9778b270e29bac3e16f57f9557098c45858c05de Mon Sep 17 00:00:00 2001
From: Tobias Rist <tobias.rist@joynext.com>
Date: Tue, 7 Mar 2023 09:40:37 +0100
Subject: [PATCH] fix(rcar3-drivers): check for length underflow
Origin: https://github.com/ARM-software/arm-trusted-firmware/commit/9778b270e29bac3e16f57f9557098c45858c05de
https://github.com/renesas-rcar/arm-trusted-firmware/commit/b596f580637bae919b0ac3a5471422a1f756db3b
Make sure the length of the payload is not longer than the
DRAM size in check_load_area(), and make sure the payload
end does not cross protected area start.
Signed-off-by: Tobias Rist <tobias.rist@joynext.com>
Signed-off-by: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
Change-Id: I4d687be577a138352be9f92e5b0b6f596ffffba9
---
drivers/renesas/common/io/io_rcar.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/renesas/common/io/io_rcar.c b/drivers/renesas/common/io/io_rcar.c
index c169923..603fefd 100644
--- a/drivers/renesas/common/io/io_rcar.c
+++ b/drivers/renesas/common/io/io_rcar.c
@@ -288,7 +288,7 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len)
prot_end = prot_start + DRAM_PROTECTED_SIZE;
- if (dst < dram_start || dst > dram_end - len) {
+ if (dst < dram_start || len > dram_end || dst > dram_end - len) {
ERROR("BL2: dst address is on the protected area.\n");
result = IO_FAIL;
goto done;
@@ -301,8 +301,9 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len)
goto done;
}
- if (dst < prot_start && dst > prot_start - len) {
- ERROR("BL2: loaded data is on the protected area.\n");
+ if (len > prot_start || (dst < prot_start && dst > prot_start - len)) {
+ ERROR("BL2: %s[%d] loaded data is on the protected area.\n",
+ __func__, __LINE__);
result = IO_FAIL;
goto done;
}
--
2.33.0

6
arm-trusted-firmware.spec
View File

@ -2,7 +2,7 @@
Name: arm-trusted-firmware
Version: 2.9
Release: 4
Release: 5
Summary: ARM Trusted Firmware
License: BSD
URL: https://github.com/ARM-software/arm-trusted-firmware/wiki
@ -16,6 +16,7 @@ Patch2: CVE-2024-6564.patch
Patch3: CVE-2024-6287-1.patch
# https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04
Patch4: CVE-2024-6287-2.patch
Patch5: CVE-2024-6285.patch
ExclusiveArch: aarch64
BuildRequires: dtc
@ -70,6 +71,9 @@ strip %{buildroot}/%{_datadir}/%{name}/rk3368/bl31.elf
%{_datadir}/%{name}
%changelog
* Mon Dec 16 2024 wangkai <13474090681@163.com> - 2.9-5
- Fix CVE-2024-6285
* Tue Oct 15 2024 yaoxin <yao_xin001@hoperun.com> - 2.9-4
- Fix CVE-2024-6287