mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 23:51:02 +02:00
8a0200d14a
sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
from the device via usb_control_msg(), but its callers only treat a
negative return value as failure. A device that answers the
vendor-specific GetSwocInfo request with a short IN transfer is
therefore accepted, leaving the tail of the freshly allocated
(kmalloc(), non-zeroing) swoc_info buffer uninitialized.
truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
and swocInfo->LinuxVer from that buffer into the world-readable
(0444) "truinst" sysfs attribute. An emulated/malicious USB device
(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
once per sysfs read, indefinitely. On kernels built without
init_on_alloc this leaks recently freed heap contents.
Only accept the transfer when the full structure was received.
sierra_ms_init() already retries failed queries, so well-behaved
devices are unaffected.
Fixes:
|
||
|---|---|---|
| .. | ||
| alauda.c | ||
| cypress_atacb.c | ||
| datafab.c | ||
| debug.c | ||
| debug.h | ||
| ene_ub6250.c | ||
| freecom.c | ||
| initializers.c | ||
| initializers.h | ||
| isd200.c | ||
| jumpshot.c | ||
| karma.c | ||
| Kconfig | ||
| Makefile | ||
| onetouch.c | ||
| option_ms.c | ||
| option_ms.h | ||
| protocol.c | ||
| protocol.h | ||
| realtek_cr.c | ||
| scsiglue.c | ||
| scsiglue.h | ||
| sddr09.c | ||
| sddr55.c | ||
| shuttle_usbat.c | ||
| sierra_ms.c | ||
| sierra_ms.h | ||
| transport.c | ||
| transport.h | ||
| uas-detect.h | ||
| uas.c | ||
| unusual_alauda.h | ||
| unusual_cypress.h | ||
| unusual_datafab.h | ||
| unusual_devs.h | ||
| unusual_ene_ub6250.h | ||
| unusual_freecom.h | ||
| unusual_isd200.h | ||
| unusual_jumpshot.h | ||
| unusual_karma.h | ||
| unusual_onetouch.h | ||
| unusual_realtek.h | ||
| unusual_sddr09.h | ||
| unusual_sddr55.h | ||
| unusual_uas.h | ||
| unusual_usbat.h | ||
| usb.c | ||
| usb.h | ||
| usual-tables.c | ||