1*4882a593SmuzhiyunFrom 879f57c3b1ff17b1ca0dbdc8aac9c7a814e876fc Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Chrostoper Ertl <chertl@microsoft.com> 3*4882a593SmuzhiyunDate: Thu, 28 Nov 2019 16:44:18 +0000 4*4882a593SmuzhiyunSubject: [PATCH] fru: Fix buffer overflow in ipmi_spd_print_fru 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunPartial fix for CVE-2020-5208, see 7*4882a593Smuzhiyunhttps://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunThe `ipmi_spd_print_fru` function has a similar issue as the one fixed 10*4882a593Smuzhiyunby the previous commit in `read_fru_area_section`. An initial request is 11*4882a593Smuzhiyunmade to get the `fru.size`, which is used as the size for the allocation 12*4882a593Smuzhiyunof `spd_data`. Inside a loop, further requests are performed to get the 13*4882a593Smuzhiyuncopy sizes which are not checked before being used as the size for a 14*4882a593Smuzhiyuncopy into the buffer. 15*4882a593Smuzhiyun 16*4882a593Smuzhiyun[Retrieve from: 17*4882a593Smuzhiyunhttps://github.com/ipmitool/ipmitool/commit/840fb1cbb4fb365cb9797300e3374d4faefcdb10] 18*4882a593SmuzhiyunSigned-off-by: Heiko Thiery <heiko.thiery@gmail.com> 19*4882a593Smuzhiyun--- 20*4882a593Smuzhiyun lib/dimm_spd.c | 9 ++++++++- 21*4882a593Smuzhiyun 1 file changed, 8 insertions(+), 1 deletion(-) 22*4882a593Smuzhiyun 23*4882a593Smuzhiyundiff --git a/lib/dimm_spd.c b/lib/dimm_spd.c 24*4882a593Smuzhiyunindex 41e30db..68f3b4f 100644 25*4882a593Smuzhiyun--- a/lib/dimm_spd.c 26*4882a593Smuzhiyun+++ b/lib/dimm_spd.c 27*4882a593Smuzhiyun@@ -1621,7 +1621,7 @@ ipmi_spd_print_fru(struct ipmi_intf * intf, uint8_t id) 28*4882a593Smuzhiyun struct ipmi_rq req; 29*4882a593Smuzhiyun struct fru_info fru; 30*4882a593Smuzhiyun uint8_t *spd_data, msg_data[4]; 31*4882a593Smuzhiyun- int len, offset; 32*4882a593Smuzhiyun+ uint32_t len, offset; 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun msg_data[0] = id; 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun@@ -1697,6 +1697,13 @@ ipmi_spd_print_fru(struct ipmi_intf * intf, uint8_t id) 37*4882a593Smuzhiyun } 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun len = rsp->data[0]; 40*4882a593Smuzhiyun+ if(rsp->data_len < 1 41*4882a593Smuzhiyun+ || len > rsp->data_len - 1 42*4882a593Smuzhiyun+ || len > fru.size - offset) 43*4882a593Smuzhiyun+ { 44*4882a593Smuzhiyun+ printf(" Not enough buffer size"); 45*4882a593Smuzhiyun+ return -1; 46*4882a593Smuzhiyun+ } 47*4882a593Smuzhiyun memcpy(&spd_data[offset], rsp->data + 1, len); 48*4882a593Smuzhiyun offset += len; 49*4882a593Smuzhiyun } while (offset < fru.size); 50*4882a593Smuzhiyun-- 51*4882a593Smuzhiyun2.20.1 52*4882a593Smuzhiyun 53