diff options
| author | James Forshaw <forshaw@google.com> | 2014-09-17 10:21:53 +0100 |
|---|---|---|
| committer | Stefan Bader <stefan.bader@canonical.com> | 2014-12-15 15:00:58 +0100 |
| commit | 50f09b80f5cacc6487f58ff890039a458f13fcce (patch) | |
| tree | b5d454825e0f844a165b3bdf52803635e82108f1 | |
| parent | 90bd4a9477896459a69824d86c254704e8b66ecd (diff) | |
| download | linux-2.6.32.y-drm33.z-50f09b80f5cacc6487f58ff890039a458f13fcce.tar.gz | |
USB: whiteheat: Added bounds checking for bulk command response
commit c5fd4126151855330280ea9382684980afcfdd03 upstream
This patch fixes a potential security issue in the whiteheat USB driver
which might allow a local attacker to cause kernel memory corrpution. This
is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
EHCI and XHCI busses it's possible to craft responses greater than 64
bytes leading a buffer overflow.
Signed-off-by: James Forshaw <forshaw@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(backported from commit 6817ae225cd650fb1c3295d769298c38b1eba818)
CVE-2014-3185
BugLink: http://bugs.launchpad.net/bugs/1370036
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
| -rw-r--r-- | drivers/usb/serial/whiteheat.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c index 1247be1262ae0..748c62716f494 100644 --- a/drivers/usb/serial/whiteheat.c +++ b/drivers/usb/serial/whiteheat.c @@ -1012,6 +1012,10 @@ static void command_port_read_callback(struct urb *urb) dbg("%s - command_info is NULL, exiting.", __func__); return; } + if (!urb->actual_length) { + dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__); + return; + } if (status) { dbg("%s - nonzero urb status: %d", __func__, status); if (status != -ENOENT) @@ -1033,7 +1037,8 @@ static void command_port_read_callback(struct urb *urb) /* These are unsolicited reports from the firmware, hence no waiting command to wakeup */ dbg("%s - event received", __func__); - } else if (data[0] == WHITEHEAT_GET_DTR_RTS) { + } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) && + (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) { memcpy(command_info->result_buffer, &data[1], urb->actual_length - 1); command_info->command_finished = WHITEHEAT_CMD_COMPLETE; |