[CVE-2017-12762,Trusty,SRU,1/1] isdn/i4l: fix buffer overflow

Message ID 20180202064448.31562-2-po-hsu.lin@canonical.com
State New
Headers show
Series
  • Fix for CVE-2017-12762
Related show

Commit Message

Po-Hsu Lin Feb. 2, 2018, 6:44 a.m.
From: Annie Cherkaev <annie.cherk@gmail.com>

CVE-2017-12762

This fixes a potential buffer overflow in isdn_net.c caused by an
unbounded strcpy.

[ ISDN seems to be effectively unmaintained, and the I4L driver in
  particular is long deprecated, but in case somebody uses this..
    - Linus ]

Signed-off-by: Jiten Thakkar <jitenmt@gmail.com>
Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967)
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
---
 drivers/isdn/i4l/isdn_common.c | 1 +
 drivers/isdn/i4l/isdn_net.c    | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

Comments

Colin King Feb. 2, 2018, 4:05 p.m. | #1
On 02/02/18 06:44, Po-Hsu Lin wrote:
> From: Annie Cherkaev <annie.cherk@gmail.com>
> 
> CVE-2017-12762
> 
> This fixes a potential buffer overflow in isdn_net.c caused by an
> unbounded strcpy.
> 
> [ ISDN seems to be effectively unmaintained, and the I4L driver in
>   particular is long deprecated, but in case somebody uses this..
>     - Linus ]
> 
> Signed-off-by: Jiten Thakkar <jitenmt@gmail.com>
> Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com>
> Cc: Karsten Keil <isdn@linux-pingi.de>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: stable@kernel.org
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
> ---
>  drivers/isdn/i4l/isdn_common.c | 1 +
>  drivers/isdn/i4l/isdn_net.c    | 5 ++---
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
> index 9bb12ba..dc16b9c 100644
> --- a/drivers/isdn/i4l/isdn_common.c
> +++ b/drivers/isdn/i4l/isdn_common.c
> @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
>  			if (arg) {
>  				if (copy_from_user(bname, argp, sizeof(bname) - 1))
>  					return -EFAULT;
> +				bname[sizeof(bname)-1] = 0;
>  			} else
>  				return -EINVAL;
>  			ret = mutex_lock_interruptible(&dev->mtx);
> diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
> index 8b98d53..ea51ae3 100644
> --- a/drivers/isdn/i4l/isdn_net.c
> +++ b/drivers/isdn/i4l/isdn_net.c
> @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm)
>  	char newname[10];
>  
>  	if (p) {
> -		/* Slave-Name MUST not be empty */
> -		if (!strlen(p + 1))
> +		/* Slave-Name MUST not be empty or overflow 'newname' */
> +		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
>  			return NULL;
> -		strcpy(newname, p + 1);
>  		*p = 0;
>  		/* Master must already exist */
>  		if (!(n = isdn_net_findif(parm)))
> 
Looks OK to me.

Acked-by: Colin Ian King <colin.king@canonical.com>
Khaled Elmously Feb. 9, 2018, 4:41 a.m. | #2
On 2018-02-02 14:44:48 , Po-Hsu Lin wrote:
> From: Annie Cherkaev <annie.cherk@gmail.com>
> 
> CVE-2017-12762
> 
> This fixes a potential buffer overflow in isdn_net.c caused by an
> unbounded strcpy.
> 
> [ ISDN seems to be effectively unmaintained, and the I4L driver in
>   particular is long deprecated, but in case somebody uses this..
>     - Linus ]
> 
> Signed-off-by: Jiten Thakkar <jitenmt@gmail.com>
> Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com>
> Cc: Karsten Keil <isdn@linux-pingi.de>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: stable@kernel.org
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
> ---
>  drivers/isdn/i4l/isdn_common.c | 1 +
>  drivers/isdn/i4l/isdn_net.c    | 5 ++---
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
> index 9bb12ba..dc16b9c 100644
> --- a/drivers/isdn/i4l/isdn_common.c
> +++ b/drivers/isdn/i4l/isdn_common.c
> @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
>  			if (arg) {
>  				if (copy_from_user(bname, argp, sizeof(bname) - 1))
>  					return -EFAULT;
> +				bname[sizeof(bname)-1] = 0;
>  			} else
>  				return -EINVAL;
>  			ret = mutex_lock_interruptible(&dev->mtx);
> diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
> index 8b98d53..ea51ae3 100644
> --- a/drivers/isdn/i4l/isdn_net.c
> +++ b/drivers/isdn/i4l/isdn_net.c
> @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm)
>  	char newname[10];
>  
>  	if (p) {
> -		/* Slave-Name MUST not be empty */
> -		if (!strlen(p + 1))
> +		/* Slave-Name MUST not be empty or overflow 'newname' */
> +		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
>  			return NULL;
> -		strcpy(newname, p + 1);
>  		*p = 0;
>  		/* Master must already exist */
>  		if (!(n = isdn_net_findif(parm)))

Acked-by: Khalid Elmously <khalid.elmously@canonical.com>

Patch

diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 9bb12ba..dc16b9c 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1376,6 +1376,7 @@  isdn_ioctl(struct file *file, uint cmd, ulong arg)
 			if (arg) {
 				if (copy_from_user(bname, argp, sizeof(bname) - 1))
 					return -EFAULT;
+				bname[sizeof(bname)-1] = 0;
 			} else
 				return -EINVAL;
 			ret = mutex_lock_interruptible(&dev->mtx);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 8b98d53..ea51ae3 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2643,10 +2643,9 @@  isdn_net_newslave(char *parm)
 	char newname[10];
 
 	if (p) {
-		/* Slave-Name MUST not be empty */
-		if (!strlen(p + 1))
+		/* Slave-Name MUST not be empty or overflow 'newname' */
+		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
 			return NULL;
-		strcpy(newname, p + 1);
 		*p = 0;
 		/* Master must already exist */
 		if (!(n = isdn_net_findif(parm)))