From: Greg KH <gregkh@linuxfoundation.org> To: "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org Cc: linux-usb@vger.kernel.org, Sebastian Andrzej Siewior <bigeasy@linutronix.de>, Hui Peng <benquike@gmail.com>, Mathias Payer <mathias.payer@nebelwelt.net> Subject: [PATCH v2] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Date: Mon, 10 Dec 2018 09:04:43 +0100 [thread overview] Message-ID: <20181210080443.GA27035@kroah.com> (raw) In-Reply-To: <20181209163245.GA25484@kroah.com> From: Hui Peng <benquike@gmail.com> The function hso_probe reads if_num from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data. Added a length check for both locations and updated hso_probe to bail on error. This issue has been assigned CVE-2018-19985. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- v2: fixed error check to just be < 0 Added CVE to changelog text drivers/net/usb/hso.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 184c24baca15..d6916f787fce 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface) return -EIO; } + /* check if we have a valid interface */ + if (if_num > 16) { + kfree(config_data); + return -EINVAL; + } + switch (config_data[if_num]) { case 0x0: result = 0; @@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface, /* Get the interface/port specification from either driver_info or from * the device itself */ - if (id->driver_info) + if (id->driver_info) { + /* if_num is controlled by the device, driver_info is a 0 terminated + * array. Make sure, the access is in bounds! */ + for (i = 0; i <= if_num; ++i) + if (((u32 *)(id->driver_info))[i] == 0) + goto exit; port_spec = ((u32 *)(id->driver_info))[if_num]; - else + } else { port_spec = hso_get_config_data(interface); + if (port_spec < 0) + goto exit; + } /* Check if we need to switch to alt interfaces prior to port * configuration */ -- 2.19.2
WARNING: multiple messages have this Message-ID (diff)
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org Cc: linux-usb@vger.kernel.org, Sebastian Andrzej Siewior <bigeasy@linutronix.de>, Hui Peng <benquike@gmail.com>, Mathias Payer <mathias.payer@nebelwelt.net> Subject: [v2] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Date: Mon, 10 Dec 2018 09:04:43 +0100 [thread overview] Message-ID: <20181210080443.GA27035@kroah.com> (raw) From: Hui Peng <benquike@gmail.com> The function hso_probe reads if_num from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data. Added a length check for both locations and updated hso_probe to bail on error. This issue has been assigned CVE-2018-19985. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- v2: fixed error check to just be < 0 Added CVE to changelog text drivers/net/usb/hso.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 184c24baca15..d6916f787fce 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface) return -EIO; } + /* check if we have a valid interface */ + if (if_num > 16) { + kfree(config_data); + return -EINVAL; + } + switch (config_data[if_num]) { case 0x0: result = 0; @@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface, /* Get the interface/port specification from either driver_info or from * the device itself */ - if (id->driver_info) + if (id->driver_info) { + /* if_num is controlled by the device, driver_info is a 0 terminated + * array. Make sure, the access is in bounds! */ + for (i = 0; i <= if_num; ++i) + if (((u32 *)(id->driver_info))[i] == 0) + goto exit; port_spec = ((u32 *)(id->driver_info))[if_num]; - else + } else { port_spec = hso_get_config_data(interface); + if (port_spec < 0) + goto exit; + } /* Check if we need to switch to alt interfaces prior to port * configuration */
next prev parent reply other threads:[~2018-12-10 8:04 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-12-09 16:32 [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Greg KH 2018-12-09 16:32 ` Greg Kroah-Hartman 2018-12-09 19:54 ` [PATCH] " David Miller 2018-12-09 19:54 ` David Miller 2018-12-09 20:02 ` [PATCH] " Mathias Payer 2018-12-09 20:02 ` Mathias Payer 2018-12-09 20:06 ` [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] " David Miller 2018-12-09 20:06 ` David Miller 2018-12-09 20:17 ` [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] " Mathias Payer 2018-12-09 20:17 ` Mathias Payer 2018-12-09 20:40 ` [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] " David Miller 2018-12-09 20:40 ` David Miller 2018-12-09 20:59 ` [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] " Mathias Payer 2018-12-09 20:59 ` USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory Mathias Payer 2018-12-10 7:18 ` [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data,Re: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Greg KH 2018-12-10 7:18 ` Greg Kroah-Hartman 2018-12-09 20:04 ` Mathias Payer 2018-12-09 20:04 ` Mathias Payer 2018-12-10 8:04 ` Greg KH [this message] 2018-12-10 8:04 ` [v2] " Greg Kroah-Hartman 2018-12-10 12:50 ` [PATCH v2] " Sebastian Andrzej Siewior 2018-12-10 12:50 ` [v2] " Sebastian Andrzej Siewior 2018-12-12 11:40 ` [PATCH v2] " Greg KH 2018-12-12 11:40 ` [v2] " Greg Kroah-Hartman 2018-12-12 11:42 ` [PATCH v3] " Greg KH 2018-12-12 11:42 ` [v3] " Greg Kroah-Hartman 2018-12-12 23:41 ` [PATCH v3] " David Miller 2018-12-12 23:41 ` [v3] " David Miller
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181210080443.GA27035@kroah.com \ --to=gregkh@linuxfoundation.org \ --cc=benquike@gmail.com \ --cc=bigeasy@linutronix.de \ --cc=davem@davemloft.net \ --cc=linux-usb@vger.kernel.org \ --cc=mathias.payer@nebelwelt.net \ --cc=netdev@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.