lkml.org 
[lkml]   [2017]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: usb/core: slab-out-of-bounds read in cdc_parse_cdc_header
    On Thu, Sep 21, 2017 at 09:31:54AM +0200, Greg Kroah-Hartman wrote:
    > On Wed, Sep 20, 2017 at 04:45:08PM +0200, Andrey Konovalov wrote:
    > > Hi!
    > >
    > > I've got the following crash while fuzzing the kernel with syzkaller.
    > >
    > > On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
    > >
    > > It looks like cdc_parse_cdc_header() doesn't validate buflen before
    > > accessing buffer[1], buffer[2] and so on. The only check present is
    > > while (buflen > 0).
    >
    > Ugh, you are right, let me go work on a patch, thanks for the report...

    Here's a first cut at a fix for this. I think this should solve it, but
    it's early and my coffee has not fully kicked in...

    thanks,

    greg k-h
    -----------------

    diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
    index 4c38ea41ae96..028feaf01aa5 100644
    --- a/drivers/usb/core/message.c
    +++ b/drivers/usb/core/message.c
    @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
    elength = 1;
    goto next_desc;
    }
    + if ((buflen < elength) || (elength < 2)) {
    + dev_err(&intf->dev, "invalid descriptor buffer length\n");
    + break;
    + }
    if (buffer[1] != USB_DT_CS_INTERFACE) {
    dev_err(&intf->dev, "skipping garbage\n");
    goto next_desc;
    \
     
     \ /
      Last update: 2017-09-21 19:29    [W:3.135 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site