From patchwork Mon Dec 5 09:28:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Szymon Heidrich X-Patchwork-Id: 1712184 X-Patchwork-Delegate: marek.vasut@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20210112 header.b=NkwrS2Ce; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4NQdXd4GTpz23ns for ; Mon, 5 Dec 2022 20:29:05 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 1A5FD85429; Mon, 5 Dec 2022 10:28:59 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="NkwrS2Ce"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 678A485429; Mon, 5 Dec 2022 10:28:57 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3069A82F69 for ; Mon, 5 Dec 2022 10:28:52 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=szymon.heidrich@gmail.com Received: by mail-lj1-x231.google.com with SMTP id z4so12829480ljq.6 for ; Mon, 05 Dec 2022 01:28:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ww086kQ6t2vpJOG/EZMMuaZ2ZeqcINHqa5xKSqqmWjw=; b=NkwrS2CeRX9tQnVcTLcsKMsmXESPWjjNw3hagigUIIAaPQ/St2TbLVoeyS1ZRyv9iR kFtTlUUw8sA7pxArL373EQKeHmoWUxbGp4w9aiqHOf7qO8LSljHYTO77/6ISUqGC+Yzh gz2B80RVqldKisZGsUjKZoGOmpeRS52Wsb3XYtnKTd7klEf3ARHOXy0WTALQ7Nx96umG VoI6zz9oIYrvtvmGcm7bgapJ6H54f+N1ezXos4xwxUdf1rklONfAUzh3xEjAGJfxEqtM IdstqnW5v0EkQEgauo5JlUNI6Br+z7dqoy/Q4jxEfPwUdbz0BhAtDkJVcrEBGwTfl9t9 V4RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ww086kQ6t2vpJOG/EZMMuaZ2ZeqcINHqa5xKSqqmWjw=; b=Tv8SmIV9zIkRrP2ZDqJbSCCsuYcMQ/8BSWj6ZmEaENFLPJFM4nK7EysK8jxZWnuvT8 InYw5rlrWbDtvM6fiYXB5NdHhWzrKJUeUBPbie31+2tbrj53kEVPlOmedk+h62RQGquw te1XXJK4adzW9alK/PtPEcuFKP6FdKTZt4JCgT2fWze6jwFcbzHjL24emgiFui1WEbSo 0yWIUsMyABmZr3+Ak1XERUndIx+lDrxT6UtRYKFtlLCacwUtNYkw0JFPHSXwtH3pvmat scmOdr5y41ssSYytbx2mkd38HchmH+sFQ3QOvF5prvgqjdJaYwIeQNHhP20jJYvbcIuU 7Xow== X-Gm-Message-State: ANoB5pmM2VuU813HkrrC1Xqdn2T9BpOoi642VbfLVOhvXOcnQ6B6t2go vq36wgzMs1Q3joj7erfPnTo= X-Google-Smtp-Source: AA0mqf7DQpNil0FBXCvDP354qMDtkUuzcab2WxatECBOYOcr/ARwTMKWw+OXqa+CgoRQZNFKPXT3Lg== X-Received: by 2002:a2e:bc25:0:b0:279:91ea:360e with SMTP id b37-20020a2ebc25000000b0027991ea360emr13713242ljf.334.1670232531341; Mon, 05 Dec 2022 01:28:51 -0800 (PST) Received: from localhost.localdomain (159-205-155-92.adsl.inetia.pl. [159.205.155.92]) by smtp.googlemail.com with ESMTPSA id r11-20020ac25a4b000000b004a93b8508edsm2054968lfn.181.2022.12.05.01.28.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Dec 2022 01:28:50 -0800 (PST) From: Szymon Heidrich To: marex@denx.de, festevam@gmail.com, lukma@denx.de Cc: szymon.heidrich@gmail.com, u-boot@lists.denx.de Subject: [PATCH v2] usb: gadget: rndis: Prevent InformationBufferOffset manipulation Date: Mon, 5 Dec 2022 10:28:23 +0100 Message-Id: <20221205092823.41742-1-szymon.heidrich@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <58ee51c7-a318-7002-11eb-27aa79614e71@denx.de> References: <58ee51c7-a318-7002-11eb-27aa79614e71@denx.de> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Prevent access to arbitrary memory locations in gen_ndis_set_resp via manipulation of buf->InformationBufferOffset. Original implementation permits manipulation of InformationBufferOffset to exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents within a 32byte offset as the devices packet filter. The packet filter value may be next retrieved using gen_ndis_query_resp so it is possible to extract specific memory regions two bytes a time. The rndis_query_response was not modified as neither the buffer offset nor length passed to gen_ndis_query_resp is used. Signed-off-by: Szymon Heidrich --- V1 -> V2: Updated commit message drivers/usb/gadget/rndis.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index 13c327ea38..3948f2cc9a 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -855,14 +855,17 @@ static int rndis_set_response(int configNr, rndis_set_msg_type *buf) rndis_set_cmplt_type *resp; rndis_resp_t *r; + BufLength = get_unaligned_le32(&buf->InformationBufferLength); + BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); + if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) || + (BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset)) + return -EINVAL; + r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type)); if (!r) return -ENOMEM; resp = (rndis_set_cmplt_type *) r->buf; - BufLength = get_unaligned_le32(&buf->InformationBufferLength); - BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); - #ifdef VERBOSE debug("%s: Length: %d\n", __func__, BufLength); debug("%s: Offset: %d\n", __func__, BufOffset);