lkml.org 
[lkml]   [2017]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 020/178] usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Shuah Khan <shuahkh@osg.samsung.com>

    commit be6123df1ea8f01ee2f896a16c2b7be3e4557a5a upstream.

    stub_send_ret_submit() handles urb with a potential null transfer_buffer,
    when it replays a packet with potential malicious data that could contain
    a null buffer. Add a check for the condition when actual_length > 0 and
    transfer_buffer is null.

    Reported-by: Secunia Research <vuln@secunia.com>
    Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/usbip/stub_tx.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/drivers/usb/usbip/stub_tx.c
    +++ b/drivers/usb/usbip/stub_tx.c
    @@ -181,6 +181,13 @@ static int stub_send_ret_submit(struct s
    memset(&pdu_header, 0, sizeof(pdu_header));
    memset(&msg, 0, sizeof(msg));

    + if (urb->actual_length > 0 && !urb->transfer_buffer) {
    + dev_err(&sdev->udev->dev,
    + "urb: actual_length %d transfer_buffer null\n",
    + urb->actual_length);
    + return -1;
    + }
    +
    if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
    iovnum = 2 + urb->number_of_packets;
    else

    \
     
     \ /
      Last update: 2017-12-18 17:12    [W:4.654 / U:0.788 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site