diff options
Diffstat (limited to 'meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648')
3 files changed, 0 insertions, 181 deletions
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch deleted file mode 100644 index 230a7bb0a..000000000 --- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 63c22eddb8fba1b6ffb845765e91587e998e470e Mon Sep 17 00:00:00 2001 -From: Simon Glass <sjg@chromium.org> -Date: Tue, 31 Mar 2020 18:43:55 +0200 -Subject: [PATCH] image: Be a little more verbose when checking signatures - -It is useful to be a little more specific about what is being checked. -Update a few messages to help with this. - -Signed-off-by: Simon Glass <sjg@chromium.org> -Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> ---- - common/image-fit.c | 2 +- - tools/image-host.c | 3 ++- - 2 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/common/image-fit.c b/common/image-fit.c -index 06f3358c931c..58923cbc9371 100644 ---- a/common/image-fit.c -+++ b/common/image-fit.c -@@ -1850,7 +1850,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr, - fit_uname = fit_get_name(fit, noffset, NULL); - } - if (noffset < 0) { -- puts("Could not find subimage node\n"); -+ printf("Could not find subimage node type '%s'\n", prop_name); - bootstage_error(bootstage_id + BOOTSTAGE_SUB_SUBNODE); - return -ENOENT; - } -diff --git a/tools/image-host.c b/tools/image-host.c -index 88b329502ca3..8e94ee8f3e31 100644 ---- a/tools/image-host.c -+++ b/tools/image-host.c -@@ -743,7 +743,8 @@ int fit_check_sign(const void *fit, const void *key) - if (!cfg_noffset) - return -1; - -- printf("Verifying Hash Integrity ... "); -+ printf("Verifying Hash Integrity for node '%s'... ", -+ fdt_get_name(fit, cfg_noffset, NULL)); - ret = fit_config_verify(fit, cfg_noffset); - if (ret) - return ret; --- -2.17.1 - diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch deleted file mode 100644 index 5f82abeda..000000000 --- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 2fa27334977ba688f17edb6b66c8eb355d4a53a5 Mon Sep 17 00:00:00 2001 -From: Simon Glass <sjg@chromium.org> -Date: Tue, 31 Mar 2020 18:43:55 +0200 -Subject: [PATCH] image: Return an error message from fit_config_verify_sig() - -This function only returns an error message sometimes. Update it to always -return an error message if one is available. This makes it easier to see -what went wrong. - -Signed-off-by: Simon Glass <sjg@chromium.org> -Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> ---- - common/image-sig.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/common/image-sig.c b/common/image-sig.c -index 4f6b4ec412c3..48c89f930276 100644 ---- a/common/image-sig.c -+++ b/common/image-sig.c -@@ -470,13 +470,14 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset, - goto error; - } - -- return verified ? 0 : -EPERM; -+ if (verified) -+ return 0; - - error: - printf(" error!\n%s for '%s' hash node in '%s' config node\n", - err_msg, fit_get_name(fit, noffset, NULL), - fit_get_name(fit, conf_noffset, NULL)); -- return -1; -+ return -EPERM; - } - - int fit_config_verify_required_sigs(const void *fit, int conf_noffset, --- -2.17.1 - diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch deleted file mode 100644 index 9dd5e6668..000000000 --- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch +++ /dev/null @@ -1,97 +0,0 @@ -From c7c1af4f9996986f05ced17694b68a575eda328e Mon Sep 17 00:00:00 2001 -From: Simon Glass <sjg@chromium.org> -Date: Tue, 31 Mar 2020 18:43:55 +0200 -Subject: [PATCH] image: Check hash-nodes when checking configurations - -It is currently possible to use a different configuration's signature and -thus bypass the configuration check. Make sure that the configuration node -that was hashed matches the one being checked, to catch this problem. - -Also add a proper function comment to fit_config_check_sig() and make it -static. - -Signed-off-by: Simon Glass <sjg@chromium.org> -Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> ---- - common/image-sig.c | 36 +++++++++++++++++++++++++++++++++--- - 1 file changed, 33 insertions(+), 3 deletions(-) - -diff --git a/common/image-sig.c b/common/image-sig.c -index 48c89f930276..4526c82acf75 100644 ---- a/common/image-sig.c -+++ b/common/image-sig.c -@@ -330,20 +330,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, - return 0; - } - --int fit_config_check_sig(const void *fit, int noffset, int required_keynode, -- char **err_msgp) -+/** -+ * fit_config_check_sig() - Check the signature of a config -+ * -+ * @fit: FIT to check -+ * @noffset: Offset of configuration node (e.g. /configurations/conf-1) -+ * @required_keynode: Offset in the control FDT of the required key node, -+ * if any. If this is given, then the configuration wil not -+ * pass verification unless that key is used. If this is -+ * -1 then any signature will do. -+ * @conf_noffset: Offset of the configuration subnode being checked (e.g. -+ * /configurations/conf-1/kernel) -+ * @err_msgp: In the event of an error, this will be pointed to a -+ * help error string to display to the user. -+ * @return 0 if all verified ok, <0 on error -+ */ -+static int fit_config_check_sig(const void *fit, int noffset, -+ int required_keynode, int conf_noffset, -+ char **err_msgp) - { - char * const exc_prop[] = {"data"}; - const char *prop, *end, *name; - struct image_sign_info info; - const uint32_t *strings; -+ const char *config_name; - uint8_t *fit_value; - int fit_value_len; -+ bool found_config; - int max_regions; - int i, prop_len; - char path[200]; - int count; - -+ config_name = fit_get_name(fit, conf_noffset, NULL); - debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(), - fit_get_name(fit, noffset, NULL), - fit_get_name(gd_fdt_blob(), required_keynode, NULL)); -@@ -384,9 +403,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode, - char *node_inc[count]; - - debug("Hash nodes (%d):\n", count); -+ found_config = false; - for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) { - debug(" '%s'\n", name); - node_inc[i] = (char *)name; -+ if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) && -+ name[sizeof(FIT_CONFS_PATH) - 1] == '/' && -+ !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) { -+ debug(" (found config node %s)", config_name); -+ found_config = true; -+ } -+ } -+ if (!found_config) { -+ *err_msgp = "Selected config not in hashed nodes"; -+ return -1; - } - - /* -@@ -454,7 +484,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset, - if (!strncmp(name, FIT_SIG_NODENAME, - strlen(FIT_SIG_NODENAME))) { - ret = fit_config_check_sig(fit, noffset, sig_offset, -- &err_msg); -+ conf_noffset, &err_msg); - if (ret) { - puts("- "); - } else { --- -2.17.1 - |