helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-08-14 03:20:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

u-boot: fix CVE-2025-24857

Browse Source 
According to [1], Improper access control for volatile memory containing boot
code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019,
IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker
to execute arbitrary code.

Backport a patch [2] from upstream to fix CVE-2025-24857

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24857
[2] 87d85139a9

(From OE-Core rev: 6f69c878896b536f5f7b16c566d420e188c82c7f)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hongxu Jia 2026-01-05 15:32:25 +08:00 committed by Paul Barker
parent 957ae42637
commit e3072d229a
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
meta/recipes-bsp/u-boot/files/CVE-2025-24857.patch Normal file
View File

@ -0,0 +1,42 @@
From 15a46d72515c04d0eeaca19bf0356a39efc9cf93 Mon Sep 17 00:00:00 2001
From: Tom Rini <trini@konsulko.com>
Date: Tue, 9 Dec 2025 15:23:01 -0600
Subject: [PATCH] fs: fat: Perform sanity checks on getsize in get_fatent()
We do not perform a check on the value of getsize in get_fatent to
ensure that it will fit within the allocated buffer. For safety sake,
add a check now and if the value exceeds FATBUFBLOCKS use that value
instead. While not currently actively exploitable, it was in the past so
adding this check is worthwhile.
This addresses CVE-2025-24857 and was originally reported by Harvey
Phillips of Amazon Element55.
Signed-off-by: Tom Rini <trini@konsulko.com>
CVE: CVE-2025-24857
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
fs/fat/fat.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/fat/fat.c b/fs/fat/fat.c
index e2570e81676..f6dc7ed15fe 100644
--- a/fs/fat/fat.c
+++ b/fs/fat/fat.c
@@ -215,6 +215,11 @@ static __u32 get_fatent(fsdata *mydata, __u32 entry)
if (flush_dirty_fat_buffer(mydata) < 0)
return -1;
+ if (getsize > FATBUFBLOCKS) {
+ debug("getsize is too large for bufptr\n");
+ getsize = FATBUFBLOCKS;
+ }
+
if (disk_read(startblock, getsize, bufptr) < 0) {
debug("Error reading FAT blocks\n");
return ret;
--
2.49.0

4
meta/recipes-bsp/u-boot/u-boot-common.inc
View File

@ -14,7 +14,9 @@ PE = "1"
# repo during parse
SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2025-24857.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build"