Syed Labeeq Sajid Bukhari 8a0200d14a usb: storage: sierra_ms: reject short SWoC info transfers ... sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc_info buffer uninitialized. truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init_on_alloc this leaks recently freed heap contents. Only accept the transfer when the full structure was received. sierra_ms_init() already retries failed queries, so well-behaved devices are unaffected. Fixes: 32fe5e3934 ("USB Storage Sierra: TRU-Install feature update") Cc: stable <stable@kernel.org> Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com> Assisted-by: Kimi:K2 [Kimi Code CLI] Link: https://patch.msgid.link/20260910140343.49371-1-syedlabeeq@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-09-10 17:08:52 +02:00
..
alauda.c
cypress_atacb.c
datafab.c
debug.c
debug.h
ene_ub6250.c
freecom.c
initializers.c
initializers.h
isd200.c
jumpshot.c
karma.c
Kconfig
Makefile
onetouch.c
option_ms.c
option_ms.h
protocol.c
protocol.h
realtek_cr.c	usb: storage: realtek_cr: fix use-after-free on disconnect	2026-09-01 16:48:45 +02:00
scsiglue.c
scsiglue.h
sddr09.c
sddr55.c
shuttle_usbat.c
sierra_ms.c	usb: storage: sierra_ms: reject short SWoC info transfers	2026-09-10 17:08:52 +02:00
sierra_ms.h
transport.c
transport.h
uas-detect.h
uas.c
unusual_alauda.h
unusual_cypress.h
unusual_datafab.h
unusual_devs.h
unusual_ene_ub6250.h
unusual_freecom.h
unusual_isd200.h
unusual_jumpshot.h
unusual_karma.h
unusual_onetouch.h
unusual_realtek.h
unusual_sddr09.h
unusual_sddr55.h
unusual_uas.h
unusual_usbat.h
usb.c
usb.h
usual-tables.c