From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933097AbdCaJcq (ORCPT ); Fri, 31 Mar 2017 05:32:46 -0400 Received: from mx2.suse.de ([195.135.220.15]:46387 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933058AbdCaJco (ORCPT ); Fri, 31 Mar 2017 05:32:44 -0400 Message-ID: <1490952676.30466.5.camel@suse.com> Subject: Re: [PATCH v3 1/4] cdc-acm: fix possible invalid access when processing notification From: Oliver Neukum To: Tobias Herzog Cc: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, stable@vger.kernel.org Date: Fri, 31 Mar 2017 11:31:16 +0200 In-Reply-To: <1490904913-3222-2-git-send-email-t-herzog@gmx.de> References: <1479118868.21146.4.camel@suse.com> <1490904913-3222-1-git-send-email-t-herzog@gmx.de> <1490904913-3222-2-git-send-email-t-herzog@gmx.de> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Am Donnerstag, den 30.03.2017, 22:15 +0200 schrieb Tobias Herzog: > Notifications may only be 8 bytes long. Accessing the 9th and > 10th byte of unimplemented/unknown notifications may be insecure. > Also check the length of known notifications before accessing anything > behind the 8th byte. > > Signed-off-by: Tobias Herzog Acked-by: Oliver Neukum