| Message ID | 20171208043819.12828-2-po-hsu.lin@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [CVE-2017-15102,SRU,Trusty,1/1] usb: misc: legousbtower: Fix NULL pointer deference | expand |
On 12/08/17 05:38, Po-Hsu Lin wrote: > From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > CVE-2017-15102 > > This patch fixes a NULL pointer dereference caused by a race codition in > the probe function of the legousbtower driver. It re-structures the > probe function to only register the interface after successfully reading > the board's firmware ID. > > The probe function does not deregister the usb interface after an error > receiving the devices firmware ID. The device file registered > (/dev/usb/legousbtower%d) may be read/written globally before the probe > function returns. When tower_delete is called in the probe function > (after an r/w has been initiated), core dev structures are deleted while > the file operation functions are still running. If the 0 address is > mappable on the machine, this vulnerability can be used to create a > Local Priviege Escalation exploit via a write-what-where condition by > remapping dev->interrupt_out_buffer in tower_write. A forged USB device > and local program execution would be required for LPE. The USB device > would have to delay the control message in tower_probe and accept > the control urb in tower_open whilst guest code initiated a write to the > device file as tower_delete is called from the error in tower_probe. > > This bug has existed since 2003. Patch tested by emulated device. > > Reported-by: James Patrick-Evans <james@jmp-e.com> > Tested-by: James Patrick-Evans <james@jmp-e.com> > Signed-off-by: James Patrick-Evans <james@jmp-e.com> > Cc: stable <stable@vger.kernel.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > (cherry picked from commit 2fae9e5a7babada041e2e161699ade2447a01989) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> > --- > drivers/usb/misc/legousbtower.c | 35 +++++++++++++++++------------------ > 1 file changed, 17 insertions(+), 18 deletions(-) > > diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c > index eb37c95..ae7a2f1 100644 > --- a/drivers/usb/misc/legousbtower.c > +++ b/drivers/usb/misc/legousbtower.c > @@ -899,24 +899,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device > dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; > dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; > > - /* we can register the device now, as it is ready */ > - usb_set_intfdata (interface, dev); > - > - retval = usb_register_dev (interface, &tower_class); > - > - if (retval) { > - /* something prevented us from registering this driver */ > - dev_err(idev, "Not able to get a minor for this device.\n"); > - usb_set_intfdata (interface, NULL); > - goto error; > - } > - dev->minor = interface->minor; > - > - /* let the user know what node this device is now attached to */ > - dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " > - "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), > - USB_MAJOR, dev->minor); > - > /* get the firmware version and log it */ > result = usb_control_msg (udev, > usb_rcvctrlpipe(udev, 0), > @@ -937,6 +919,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device > get_version_reply.minor, > le16_to_cpu(get_version_reply.build_no)); > > + /* we can register the device now, as it is ready */ > + usb_set_intfdata (interface, dev); > + > + retval = usb_register_dev (interface, &tower_class); > + > + if (retval) { > + /* something prevented us from registering this driver */ > + dev_err(idev, "Not able to get a minor for this device.\n"); > + usb_set_intfdata (interface, NULL); > + goto error; > + } > + dev->minor = interface->minor; > + > + /* let the user know what node this device is now attached to */ > + dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " > + "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), > + USB_MAJOR, dev->minor); > > exit: > return retval; >
On 08.12.2017 04:38, Po-Hsu Lin wrote: > From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > CVE-2017-15102 > > This patch fixes a NULL pointer dereference caused by a race codition in > the probe function of the legousbtower driver. It re-structures the > probe function to only register the interface after successfully reading > the board's firmware ID. > > The probe function does not deregister the usb interface after an error > receiving the devices firmware ID. The device file registered > (/dev/usb/legousbtower%d) may be read/written globally before the probe > function returns. When tower_delete is called in the probe function > (after an r/w has been initiated), core dev structures are deleted while > the file operation functions are still running. If the 0 address is > mappable on the machine, this vulnerability can be used to create a > Local Priviege Escalation exploit via a write-what-where condition by > remapping dev->interrupt_out_buffer in tower_write. A forged USB device > and local program execution would be required for LPE. The USB device > would have to delay the control message in tower_probe and accept > the control urb in tower_open whilst guest code initiated a write to the > device file as tower_delete is called from the error in tower_probe. > > This bug has existed since 2003. Patch tested by emulated device. > > Reported-by: James Patrick-Evans <james@jmp-e.com> > Tested-by: James Patrick-Evans <james@jmp-e.com> > Signed-off-by: James Patrick-Evans <james@jmp-e.com> > Cc: stable <stable@vger.kernel.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > (cherry picked from commit 2fae9e5a7babada041e2e161699ade2447a01989) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- > drivers/usb/misc/legousbtower.c | 35 +++++++++++++++++------------------ > 1 file changed, 17 insertions(+), 18 deletions(-) > > diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c > index eb37c95..ae7a2f1 100644 > --- a/drivers/usb/misc/legousbtower.c > +++ b/drivers/usb/misc/legousbtower.c > @@ -899,24 +899,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device > dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; > dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; > > - /* we can register the device now, as it is ready */ > - usb_set_intfdata (interface, dev); > - > - retval = usb_register_dev (interface, &tower_class); > - > - if (retval) { > - /* something prevented us from registering this driver */ > - dev_err(idev, "Not able to get a minor for this device.\n"); > - usb_set_intfdata (interface, NULL); > - goto error; > - } > - dev->minor = interface->minor; > - > - /* let the user know what node this device is now attached to */ > - dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " > - "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), > - USB_MAJOR, dev->minor); > - > /* get the firmware version and log it */ > result = usb_control_msg (udev, > usb_rcvctrlpipe(udev, 0), > @@ -937,6 +919,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device > get_version_reply.minor, > le16_to_cpu(get_version_reply.build_no)); > > + /* we can register the device now, as it is ready */ > + usb_set_intfdata (interface, dev); > + > + retval = usb_register_dev (interface, &tower_class); > + > + if (retval) { > + /* something prevented us from registering this driver */ > + dev_err(idev, "Not able to get a minor for this device.\n"); > + usb_set_intfdata (interface, NULL); > + goto error; > + } > + dev->minor = interface->minor; > + > + /* let the user know what node this device is now attached to */ > + dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " > + "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), > + USB_MAJOR, dev->minor); > > exit: > return retval; >
Applied to trusty master-next branch. Thanks. Cascardo. Applied-to: trusty/master-next
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index eb37c95..ae7a2f1 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -899,24 +899,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; - /* we can register the device now, as it is ready */ - usb_set_intfdata (interface, dev); - - retval = usb_register_dev (interface, &tower_class); - - if (retval) { - /* something prevented us from registering this driver */ - dev_err(idev, "Not able to get a minor for this device.\n"); - usb_set_intfdata (interface, NULL); - goto error; - } - dev->minor = interface->minor; - - /* let the user know what node this device is now attached to */ - dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " - "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), - USB_MAJOR, dev->minor); - /* get the firmware version and log it */ result = usb_control_msg (udev, usb_rcvctrlpipe(udev, 0), @@ -937,6 +919,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device get_version_reply.minor, le16_to_cpu(get_version_reply.build_no)); + /* we can register the device now, as it is ready */ + usb_set_intfdata (interface, dev); + + retval = usb_register_dev (interface, &tower_class); + + if (retval) { + /* something prevented us from registering this driver */ + dev_err(idev, "Not able to get a minor for this device.\n"); + usb_set_intfdata (interface, NULL); + goto error; + } + dev->minor = interface->minor; + + /* let the user know what node this device is now attached to */ + dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " + "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), + USB_MAJOR, dev->minor); exit: return retval;