From patchwork Thu May 26 12:58:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 626655 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3rFq2p5Vb1z9t3q; Thu, 26 May 2016 22:58:42 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1b5us3-00015d-RY; Thu, 26 May 2016 12:58:39 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1b5urp-00011t-OI for kernel-team@lists.ubuntu.com; Thu, 26 May 2016 12:58:25 +0000 Received: from 1.general.henrix.uk.vpn ([10.172.192.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1b5urp-00069T-CZ for kernel-team@lists.ubuntu.com; Thu, 26 May 2016 12:58:25 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/2][Precise][Trusty] USB: usbfs: fix potential infoleak in devio Date: Thu, 26 May 2016 13:58:22 +0100 Message-Id: <1464267503-20149-2-git-send-email-luis.henriques@canonical.com> In-Reply-To: <1464267503-20149-1-git-send-email-luis.henriques@canonical.com> References: <1464267503-20149-1-git-send-email-luis.henriques@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Kangjie Lu The stack object “ci” has a total size of 8 bytes. Its last 3 bytes are padding bytes which are not initialized and leaked to userland via “copy_to_user”. Signed-off-by: Kangjie Lu Signed-off-by: Greg Kroah-Hartman (backported from commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee) CVE-2016-4482 BugLink: https://bugs.launchpad.net/bugs/1578493 Signed-off-by: Luis Henriques --- drivers/usb/core/devio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 64340f3e0792..ed11901ab8ab 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1005,10 +1005,11 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg) static int proc_connectinfo(struct dev_state *ps, void __user *arg) { - struct usbdevfs_connectinfo ci = { - .devnum = ps->dev->devnum, - .slow = ps->dev->speed == USB_SPEED_LOW - }; + struct usbdevfs_connectinfo ci; + + memset(&ci, 0, sizeof(ci)); + ci.devnum = ps->dev->devnum; + ci.slow = ps->dev->speed == USB_SPEED_LOW; if (copy_to_user(arg, &ci, sizeof(ci))) return -EFAULT;