lkml.org 
[lkml]   [2016]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors
    From
    Date
    On Sun, 2016-04-10 at 11:33 -0700, Greg Kroah-Hartman wrote:

    > 4.5-stable review patch.  If anyone has any objections, please let me know.
    >
    > ------------------
    >
    > From: Josh Boyer <jwboyer@fedoraproject.org>
    >
    > commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.
    >
    > The iowarrior driver expects at least one valid endpoint.  If given
    > malicious descriptors that specify 0 for the number of endpoints,
    > it will crash in the probe function.  Ensure there is at least
    > one endpoint on the interface before using it.
    [...]

    Which means our imaginary attacker will move on to providing a single
    endpoint of the wrong type.  You've fixed the driver to reject the PoC
    descriptor without thinking about what the driver actually requires.

    I don't see the point of applying this to stable; it doesn't provide
    any meaningful security benefit.

    Ben.

    --
    Ben Hutchings
    This sentence contradicts itself - no actually it doesn't.[unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2016-04-12 04:01    [W:3.897 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site