From f9342adcc82294ba2fd7809f49d601441a0998a7 Mon Sep 17 00:00:00 2001 From: wk333 <13474090681@163.com> Date: Mon, 16 Dec 2024 16:42:06 +0800 Subject: [PATCH] Fix CVE-2024-6285 --- CVE-2024-6285.patch | 47 +++++++++++++++++++++++++++++++++++++++ arm-trusted-firmware.spec | 6 ++++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 CVE-2024-6285.patch diff --git a/CVE-2024-6285.patch b/CVE-2024-6285.patch new file mode 100644 index 0000000..9b2a369 --- /dev/null +++ b/CVE-2024-6285.patch @@ -0,0 +1,47 @@ +From 9778b270e29bac3e16f57f9557098c45858c05de Mon Sep 17 00:00:00 2001 +From: Tobias Rist +Date: Tue, 7 Mar 2023 09:40:37 +0100 +Subject: [PATCH] fix(rcar3-drivers): check for length underflow + +Origin: https://github.com/ARM-software/arm-trusted-firmware/commit/9778b270e29bac3e16f57f9557098c45858c05de +https://github.com/renesas-rcar/arm-trusted-firmware/commit/b596f580637bae919b0ac3a5471422a1f756db3b + +Make sure the length of the payload is not longer than the +DRAM size in check_load_area(), and make sure the payload +end does not cross protected area start. + +Signed-off-by: Tobias Rist +Signed-off-by: Yoshifumi Hosoya +Change-Id: I4d687be577a138352be9f92e5b0b6f596ffffba9 +--- + drivers/renesas/common/io/io_rcar.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/renesas/common/io/io_rcar.c b/drivers/renesas/common/io/io_rcar.c +index c169923..603fefd 100644 +--- a/drivers/renesas/common/io/io_rcar.c ++++ b/drivers/renesas/common/io/io_rcar.c +@@ -288,7 +288,7 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len) + + prot_end = prot_start + DRAM_PROTECTED_SIZE; + +- if (dst < dram_start || dst > dram_end - len) { ++ if (dst < dram_start || len > dram_end || dst > dram_end - len) { + ERROR("BL2: dst address is on the protected area.\n"); + result = IO_FAIL; + goto done; +@@ -301,8 +301,9 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len) + goto done; + } + +- if (dst < prot_start && dst > prot_start - len) { +- ERROR("BL2: loaded data is on the protected area.\n"); ++ if (len > prot_start || (dst < prot_start && dst > prot_start - len)) { ++ ERROR("BL2: %s[%d] loaded data is on the protected area.\n", ++ __func__, __LINE__); + result = IO_FAIL; + goto done; + } +-- +2.33.0 + diff --git a/arm-trusted-firmware.spec b/arm-trusted-firmware.spec index 965b67b..67a1c04 100644 --- a/arm-trusted-firmware.spec +++ b/arm-trusted-firmware.spec @@ -2,7 +2,7 @@ Name: arm-trusted-firmware Version: 2.9 -Release: 4 +Release: 5 Summary: ARM Trusted Firmware License: BSD URL: https://github.com/ARM-software/arm-trusted-firmware/wiki @@ -16,6 +16,7 @@ Patch2: CVE-2024-6564.patch Patch3: CVE-2024-6287-1.patch # https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04 Patch4: CVE-2024-6287-2.patch +Patch5: CVE-2024-6285.patch ExclusiveArch: aarch64 BuildRequires: dtc @@ -70,6 +71,9 @@ strip %{buildroot}/%{_datadir}/%{name}/rk3368/bl31.elf %{_datadir}/%{name} %changelog +* Mon Dec 16 2024 wangkai <13474090681@163.com> - 2.9-5 +- Fix CVE-2024-6285 + * Tue Oct 15 2024 yaoxin - 2.9-4 - Fix CVE-2024-6287 -- Gitee