diff options
| author | Tom Rini <trini@konsulko.com> | 2021-02-15 19:19:56 -0500 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2021-02-15 22:31:54 -0500 |
| commit | b6f4c757959f8850e1299a77c8e5713da78e8ec0 (patch) | |
| tree | 2de8580b23f833e100a186448625721d71625521 /common/image-fit-sig.c | |
| parent | 6144438fb5c9059dc87cf219bed0c992f70b3509 (diff) | |
| parent | 3f04db891a353f4b127ed57279279f851c6b4917 (diff) | |
Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'
Fix CVE-2021-27097 and CVE-2021-27138. For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138
Diffstat (limited to 'common/image-fit-sig.c')
| -rw-r--r-- | common/image-fit-sig.c | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/common/image-fit-sig.c b/common/image-fit-sig.c index 897e04c7a3..34ebb8edfe 100644 --- a/common/image-fit-sig.c +++ b/common/image-fit-sig.c @@ -149,6 +149,14 @@ static int fit_image_verify_sig(const void *fit, int image_noffset, fdt_for_each_subnode(noffset, fit, image_noffset) { const char *name = fit_get_name(fit, noffset, NULL); + /* + * We don't support this since libfdt considers names with the + * name root but different @ suffix to be equal + */ + if (strchr(name, '@')) { + err_msg = "Node name contains @"; + goto error; + } if (!strncmp(name, FIT_SIG_NODENAME, strlen(FIT_SIG_NODENAME))) { ret = fit_image_check_sig(fit, noffset, data, @@ -398,9 +406,10 @@ error: return -EPERM; } -int fit_config_verify_required_sigs(const void *fit, int conf_noffset, - const void *sig_blob) +static int fit_config_verify_required_sigs(const void *fit, int conf_noffset, + const void *sig_blob) { + const char *name = fit_get_name(fit, conf_noffset, NULL); int noffset; int sig_node; int verified = 0; @@ -408,6 +417,15 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, bool reqd_policy_all = true; const char *reqd_mode; + /* + * We don't support this since libfdt considers names with the + * name root but different @ suffix to be equal + */ + if (strchr(name, '@')) { + printf("Configuration node '%s' contains '@'\n", name); + return -EPERM; + } + /* Work out what we need to verify */ sig_node = fdt_subnode_offset(sig_blob, 0, FIT_SIG_NODENAME); if (sig_node < 0) { |