diff options
| -rw-r--r-- | meta-oe/recipes-extended/redis/redis/fix-CVE-2021-29478.patch | 42 | ||||
| -rw-r--r-- | meta-oe/recipes-extended/redis/redis_6.2.2.bb | 1 |
2 files changed, 43 insertions, 0 deletions
diff --git a/meta-oe/recipes-extended/redis/redis/fix-CVE-2021-29478.patch b/meta-oe/recipes-extended/redis/redis/fix-CVE-2021-29478.patch new file mode 100644 index 0000000000..ebbf6e1b94 --- /dev/null +++ b/meta-oe/recipes-extended/redis/redis/fix-CVE-2021-29478.patch @@ -0,0 +1,42 @@ +From 29900d4e6bccdf3691bedf0ea9a5d84863fa3592 Mon Sep 17 00:00:00 2001 +From: Oran Agra <oran@redislabs.com> +Date: Mon, 3 May 2021 08:27:22 +0300 +Subject: [PATCH] Fix integer overflow in intset (CVE-2021-29478) + +An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and +potentially result with remote code execution. + +The vulnerability involves changing the default set-max-intset-entries +configuration value, creating a large set key that consists of integer values +and using the COPY command to duplicate it. + +The integer overflow bug exists in all versions of Redis starting with 2.6, +where it could result with a corrupted RDB or DUMP payload, but not exploited +through COPY (which did not exist before 6.2). + +CVE: CVE-2021-29478 +Upstream-Status: Backport +[https://github.com/redis/redis/commit/29900d4e6bccdf3691bedf0ea9a5d84863fa3592] + +Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> + +--- + src/intset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/intset.c b/src/intset.c +index 1a64ecae8..9ba13898d 100644 +--- a/src/intset.c ++++ b/src/intset.c +@@ -281,7 +281,7 @@ uint32_t intsetLen(const intset *is) { + + /* Return intset blob size in bytes. */ + size_t intsetBlobLen(intset *is) { +- return sizeof(intset)+intrev32ifbe(is->length)*intrev32ifbe(is->encoding); ++ return sizeof(intset)+(size_t)intrev32ifbe(is->length)*intrev32ifbe(is->encoding); + } + + /* Validate the integrity of the data structure. +-- +2.32.0 + diff --git a/meta-oe/recipes-extended/redis/redis_6.2.2.bb b/meta-oe/recipes-extended/redis/redis_6.2.2.bb index e89bb50f15..a36c190af3 100644 --- a/meta-oe/recipes-extended/redis/redis_6.2.2.bb +++ b/meta-oe/recipes-extended/redis/redis_6.2.2.bb @@ -17,6 +17,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \ file://GNU_SOURCE.patch \ file://0006-Define-correct-gregs-for-RISCV32.patch \ file://fix-CVE-2021-29477.patch \ + file://fix-CVE-2021-29478.patch \ " SRC_URI[sha256sum] = "7a260bb74860f1b88c3d5942bf8ba60ca59f121c6dce42d3017bed6add0b9535" |