Skip to content

Commit 6817ae2

Browse files
James Forshawgregkh
James Forshaw
authored andcommitted
USB: whiteheat: Added bounds checking for bulk command response
This patch fixes a potential security issue in the whiteheat USB driver which might allow a local attacker to cause kernel memory corrpution. This is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On EHCI and XHCI busses it's possible to craft responses greater than 64 bytes leading a buffer overflow. Signed-off-by: James Forshaw <forshaw@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent c3d3af5 commit 6817ae2

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

Diff for: drivers/usb/serial/whiteheat.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
514514
dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
515515
return;
516516
}
517+
if (!urb->actual_length) {
518+
dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
519+
return;
520+
}
517521
if (status) {
518522
dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
519523
if (status != -ENOENT)
@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
534538
/* These are unsolicited reports from the firmware, hence no
535539
waiting command to wakeup */
536540
dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
537-
} else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
541+
} else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
542+
(urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
538543
memcpy(command_info->result_buffer, &data[1],
539544
urb->actual_length - 1);
540545
command_info->command_finished = WHITEHEAT_CMD_COMPLETE;

0 commit comments

Comments
 (0)