| Message ID | 20180720153827.18801-2-colin.king@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | Input: ims-psu - check if CDC union descriptor is sane | expand |
On 20.07.2018 17:38, Colin King wrote: > From: Dmitry Torokhov <dmitry.torokhov@gmail.com> > > CVE-2017-16645 > > Before trying to use CDC union descriptor, try to validate whether that it > is sane by checking that intf->altsetting->extra is big enough and that > descriptor bLength is not too big and not too small. > > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> > (clean cherry pick from upstream commit ea04efee7635c9120d015dcdeeeb6988130cb67a) > Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- -> (cherry picked from commit ea04efee7635c9120d015dcdeeeb6988130cb67a) > drivers/input/misc/ims-pcu.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c > index 6bf82ea..ae47312 100644 > --- a/drivers/input/misc/ims-pcu.c > +++ b/drivers/input/misc/ims-pcu.c > @@ -1635,13 +1635,25 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu) > return NULL; > } > > - while (buflen > 0) { > + while (buflen >= sizeof(*union_desc)) { > union_desc = (struct usb_cdc_union_desc *)buf; > > + if (union_desc->bLength > buflen) { > + dev_err(&intf->dev, "Too large descriptor\n"); > + return NULL; > + } > + > if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && > union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { > dev_dbg(&intf->dev, "Found union header\n"); > - return union_desc; > + > + if (union_desc->bLength >= sizeof(*union_desc)) > + return union_desc; > + > + dev_err(&intf->dev, > + "Union descriptor to short (%d vs %zd\n)", > + union_desc->bLength, sizeof(*union_desc)); > + return NULL; > } > > buflen -= union_desc->bLength; >
Applied to trusty master-next. ...Juerg On 07/20/2018 05:38 PM, Colin King wrote: > From: Dmitry Torokhov <dmitry.torokhov@gmail.com> > > CVE-2017-16645 > > Before trying to use CDC union descriptor, try to validate whether that it > is sane by checking that intf->altsetting->extra is big enough and that > descriptor bLength is not too big and not too small. > > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> > (clean cherry pick from upstream commit ea04efee7635c9120d015dcdeeeb6988130cb67a) > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/input/misc/ims-pcu.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c > index 6bf82ea..ae47312 100644 > --- a/drivers/input/misc/ims-pcu.c > +++ b/drivers/input/misc/ims-pcu.c > @@ -1635,13 +1635,25 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu) > return NULL; > } > > - while (buflen > 0) { > + while (buflen >= sizeof(*union_desc)) { > union_desc = (struct usb_cdc_union_desc *)buf; > > + if (union_desc->bLength > buflen) { > + dev_err(&intf->dev, "Too large descriptor\n"); > + return NULL; > + } > + > if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && > union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { > dev_dbg(&intf->dev, "Found union header\n"); > - return union_desc; > + > + if (union_desc->bLength >= sizeof(*union_desc)) > + return union_desc; > + > + dev_err(&intf->dev, > + "Union descriptor to short (%d vs %zd\n)", > + union_desc->bLength, sizeof(*union_desc)); > + return NULL; > } > > buflen -= union_desc->bLength; >
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c index 6bf82ea..ae47312 100644 --- a/drivers/input/misc/ims-pcu.c +++ b/drivers/input/misc/ims-pcu.c @@ -1635,13 +1635,25 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu) return NULL; } - while (buflen > 0) { + while (buflen >= sizeof(*union_desc)) { union_desc = (struct usb_cdc_union_desc *)buf; + if (union_desc->bLength > buflen) { + dev_err(&intf->dev, "Too large descriptor\n"); + return NULL; + } + if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { dev_dbg(&intf->dev, "Found union header\n"); - return union_desc; + + if (union_desc->bLength >= sizeof(*union_desc)) + return union_desc; + + dev_err(&intf->dev, + "Union descriptor to short (%d vs %zd\n)", + union_desc->bLength, sizeof(*union_desc)); + return NULL; } buflen -= union_desc->bLength;