linux-kernel - Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 May 2015 16:58:26 +0200
From:	"Jason A. Donenfeld" <Jason@...c4.com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow

On Tue, May 26, 2015 at 3:56 PM, Dan Carpenter <dan.carpenter@...cle.com> wrote:
>> elt->length is a u8, so the upper bound is 255.
>
> Yes.  I know that, but is 255 correct?

Eventually body->data is passed to oz_hcd_get_desc_cnf along with
data_len. In there, body->data (now called desc) is memcpy'd into a
URB transfer buffer. The checks to see if that transfer buffer is big
enough are broken and vulnerable, and another patch in this set
addresses that. But anyway, AFAIK, the 255 limit works fine for all
subsequent types used, after this patch set is applied. The use of a
u8 cannot, at this point, be *increased* since this protocol is tied
to particular hardware chips sold by Atmel/Ozmo. And I can't see a
reason why it should be further bounded either.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/