u-boot.git, branch v2021.04-rc2

Prepare v2021.04-rc2

2021-02-16T03:34:56+00:00

Signed-off-by: Tom Rini

Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'

2021-02-16T03:31:54+00:00

Fix CVE-2021-27097 and CVE-2021-27138.  For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138

image: Check for unit addresses in FITs

2021-02-16T03:31:54+00:00

Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.

CVE-2021-27138

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

libfdt: Check for multiple/invalid root nodes

2021-02-16T03:31:53+00:00

It is possible to construct a devicetree blob with multiple root nodes.
Update fdt_check_full() to check for this, along with a root node with an
invalid name.

CVE-2021-27097

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

image: Add an option to do a full check of the FIT

2021-02-16T03:31:53+00:00

Some strange modifications of the FIT can introduce security risks. Add an
option to check it thoroughly, using libfdt's fdt_check_full() function.

Enable this by default if signature verification is enabled.

CVE-2021-27097

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

image: Adjust the workings of fit_check_format()

2021-02-16T03:31:52+00:00

At present this function does not accept a size for the FIT. This means
that it must be read from the FIT itself, introducing potential security
risk. Update the function to include a size parameter, which can be
invalid, in which case fit_check_format() calculates it.

For now no callers pass the size, but this can be updated later.

Also adjust the return value to an error code so that all the different
types of problems can be distinguished by the user.

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Add tests for the 'evil' vboot attacks

2021-02-16T00:17:33+00:00

Add tests to check that these two attacks are mitigated by recent patches.

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Add vboot_evil implementation

2021-02-16T00:17:29+00:00

Add a library which performs two different attacks on a FIT.

Signed-off-by: Julien Lenoir 
Signed-off-by: Bruce Monroe 
Signed-off-by: Arie Haenel 
Signed-off-by: Simon Glass

fit: Don't allow verification of images with @ nodes

2021-02-16T00:17:25+00:00

When searching for a node called 'fred', any unit address appended to the
name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This
means that we cannot be sure that the node originally intended is the one
that is used.

Disallow use of nodes with unit addresses.

Update the forge test also, since it uses @ addresses.

CVE-2021-27138

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

fdt_region: Check for a single root node of the correct name

2021-02-16T00:17:18+00:00

At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.

Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.

CVE-2021-27097

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir