| Message ID | 20180202064448.31562-2-po-hsu.lin@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | Fix for CVE-2017-12762 | expand |
On 02/02/18 06:44, Po-Hsu Lin wrote: > From: Annie Cherkaev <annie.cherk@gmail.com> > > CVE-2017-12762 > > This fixes a potential buffer overflow in isdn_net.c caused by an > unbounded strcpy. > > [ ISDN seems to be effectively unmaintained, and the I4L driver in > particular is long deprecated, but in case somebody uses this.. > - Linus ] > > Signed-off-by: Jiten Thakkar <jitenmt@gmail.com> > Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com> > Cc: Karsten Keil <isdn@linux-pingi.de> > Cc: Kees Cook <keescook@chromium.org> > Cc: stable@kernel.org > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> > (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> > --- > drivers/isdn/i4l/isdn_common.c | 1 + > drivers/isdn/i4l/isdn_net.c | 5 ++--- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c > index 9bb12ba..dc16b9c 100644 > --- a/drivers/isdn/i4l/isdn_common.c > +++ b/drivers/isdn/i4l/isdn_common.c > @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) > if (arg) { > if (copy_from_user(bname, argp, sizeof(bname) - 1)) > return -EFAULT; > + bname[sizeof(bname)-1] = 0; > } else > return -EINVAL; > ret = mutex_lock_interruptible(&dev->mtx); > diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c > index 8b98d53..ea51ae3 100644 > --- a/drivers/isdn/i4l/isdn_net.c > +++ b/drivers/isdn/i4l/isdn_net.c > @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm) > char newname[10]; > > if (p) { > - /* Slave-Name MUST not be empty */ > - if (!strlen(p + 1)) > + /* Slave-Name MUST not be empty or overflow 'newname' */ > + if (strscpy(newname, p + 1, sizeof(newname)) <= 0) > return NULL; > - strcpy(newname, p + 1); > *p = 0; > /* Master must already exist */ > if (!(n = isdn_net_findif(parm))) > Looks OK to me. Acked-by: Colin Ian King <colin.king@canonical.com>
On 2018-02-02 14:44:48 , Po-Hsu Lin wrote: > From: Annie Cherkaev <annie.cherk@gmail.com> > > CVE-2017-12762 > > This fixes a potential buffer overflow in isdn_net.c caused by an > unbounded strcpy. > > [ ISDN seems to be effectively unmaintained, and the I4L driver in > particular is long deprecated, but in case somebody uses this.. > - Linus ] > > Signed-off-by: Jiten Thakkar <jitenmt@gmail.com> > Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com> > Cc: Karsten Keil <isdn@linux-pingi.de> > Cc: Kees Cook <keescook@chromium.org> > Cc: stable@kernel.org > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> > (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> > --- > drivers/isdn/i4l/isdn_common.c | 1 + > drivers/isdn/i4l/isdn_net.c | 5 ++--- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c > index 9bb12ba..dc16b9c 100644 > --- a/drivers/isdn/i4l/isdn_common.c > +++ b/drivers/isdn/i4l/isdn_common.c > @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) > if (arg) { > if (copy_from_user(bname, argp, sizeof(bname) - 1)) > return -EFAULT; > + bname[sizeof(bname)-1] = 0; > } else > return -EINVAL; > ret = mutex_lock_interruptible(&dev->mtx); > diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c > index 8b98d53..ea51ae3 100644 > --- a/drivers/isdn/i4l/isdn_net.c > +++ b/drivers/isdn/i4l/isdn_net.c > @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm) > char newname[10]; > > if (p) { > - /* Slave-Name MUST not be empty */ > - if (!strlen(p + 1)) > + /* Slave-Name MUST not be empty or overflow 'newname' */ > + if (strscpy(newname, p + 1, sizeof(newname)) <= 0) > return NULL; > - strcpy(newname, p + 1); > *p = 0; > /* Master must already exist */ > if (!(n = isdn_net_findif(parm))) Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index 9bb12ba..dc16b9c 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) if (arg) { if (copy_from_user(bname, argp, sizeof(bname) - 1)) return -EFAULT; + bname[sizeof(bname)-1] = 0; } else return -EINVAL; ret = mutex_lock_interruptible(&dev->mtx); diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c index 8b98d53..ea51ae3 100644 --- a/drivers/isdn/i4l/isdn_net.c +++ b/drivers/isdn/i4l/isdn_net.c @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm) char newname[10]; if (p) { - /* Slave-Name MUST not be empty */ - if (!strlen(p + 1)) + /* Slave-Name MUST not be empty or overflow 'newname' */ + if (strscpy(newname, p + 1, sizeof(newname)) <= 0) return NULL; - strcpy(newname, p + 1); *p = 0; /* Master must already exist */ if (!(n = isdn_net_findif(parm)))