<div dir="ltr">.. and if anyone notices, there's a kernel part to this CVE as well.<div><br></div><div>I've applied to fix to all the active linux-yocto kernels, and the change will be part</div><div>of my consolidated pull request that comes out later today.</div><div><br></div><div>Cheers,</div><div><br></div><div>Bruce<br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 14, 2017 at 8:27 AM, Ross Burton <span dir="ltr"><<a href="mailto:ross.burton@intel.com" target="_blank">ross.burton@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an<br>
information disclosure vulnerability which allows remote attackers to obtain<br>
sensitive information from the bluetoothd process memory. This vulnerability<br>
lies in the processing of SDP search attribute requests.<br>
<br>
Signed-off-by: Ross Burton <<a href="mailto:ross.burton@intel.com">ross.burton@intel.com</a>><br>
---<br>
meta/recipes-connectivity/<wbr>bluez5/bluez5.inc | 1 +<br>
.../bluez5/bluez5/cve-2017-<wbr>1000250.patch | 34 ++++++++++++++++++++++<br>
2 files changed, 35 insertions(+)<br>
create mode 100644 meta/recipes-connectivity/<wbr>bluez5/bluez5/cve-2017-<wbr>1000250.patch<br>
<br>
diff --git a/meta/recipes-connectivity/<wbr>bluez5/bluez5.inc b/meta/recipes-connectivity/<wbr>bluez5/bluez5.inc<br>
index ecefb7b593e..3421c382063 100644<br>
--- a/meta/recipes-connectivity/<wbr>bluez5/bluez5.inc<br>
+++ b/meta/recipes-connectivity/<wbr>bluez5/bluez5.inc<br>
@@ -23,6 +23,7 @@ SRC_URI = "\<br>
file://run-ptest \<br>
${@bb.utils.contains('DISTRO_<wbr>FEATURES', 'systemd', '', 'file://0001-Allow-using-<wbr>obexd-without-systemd-in-the-<wbr>user-sessio.patch', d)} \<br>
file://0001-tests-add-a-<wbr>target-for-building-tests-<wbr>without-runnin.patch \<br>
+ file://cve-2017-1000250.patch \<br>
"<br>
S = "${WORKDIR}/bluez-${PV}"<br>
<br>
diff --git a/meta/recipes-connectivity/<wbr>bluez5/bluez5/cve-2017-<wbr>1000250.patch b/meta/recipes-connectivity/<wbr>bluez5/bluez5/cve-2017-<wbr>1000250.patch<br>
new file mode 100644<br>
index 00000000000..9fac961bcf6<br>
--- /dev/null<br>
+++ b/meta/recipes-connectivity/<wbr>bluez5/bluez5/cve-2017-<wbr>1000250.patch<br>
@@ -0,0 +1,34 @@<br>
+All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an<br>
+information disclosure vulnerability which allows remote attackers to obtain<br>
+sensitive information from the bluetoothd process memory. This vulnerability<br>
+lies in the processing of SDP search attribute requests.<br>
+<br>
+CVE: CVE-2017-1000250<br>
+Upstream-Status: Backport<br>
+Signed-off-by: Ross Burton <<a href="mailto:ross.burton@intel.com">ross.burton@intel.com</a>><br>
+<br>
+From 9e009647b14e810e06626dde7f1bb9<wbr>ea3c375d09 Mon Sep 17 00:00:00 2001<br>
+From: Luiz Augusto von Dentz <<a href="mailto:luiz.von.dentz@intel.com">luiz.von.dentz@intel.com</a>><br>
+Date: Wed, 13 Sep 2017 10:01:40 +0300<br>
+Subject: sdp: Fix Out-of-bounds heap read in service_search_attr_req function<br>
+<br>
+Check if there is enough data to continue otherwise return an error.<br>
+---<br>
+ src/sdpd-request.c | 2 +-<br>
+ 1 file changed, 1 insertion(+), 1 deletion(-)<br>
+<br>
+diff --git a/src/sdpd-request.c b/src/sdpd-request.c<br>
+index 1eefdce..318d044 100644<br>
+--- a/src/sdpd-request.c<br>
++++ b/src/sdpd-request.c<br>
+@@ -917,7 +917,7 @@ static int service_search_attr_req(sdp_<wbr>req_t *req, sdp_buf_t *buf)<br>
+ } else {<br>
+ /* continuation State exists -> get from cache */<br>
+ sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);<br>
+- if (pCache) {<br>
++ if (pCache && cstate->cStateValue.<wbr>maxBytesSent < pCache->data_size) {<br>
+ uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.<wbr>maxBytesSent);<br>
+ pResponse = pCache->data;<br>
+ memcpy(buf->data, pResponse + cstate->cStateValue.<wbr>maxBytesSent, sent);<br>
+--<br>
+cgit v1.1<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.11.0<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">"Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end"</div>
</div></div></div>