linux-kernel - Re: usb/core: slab-out-of-bounds in usb_get_bos

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAAeHK+yjuojkAk9JQFL-pZFR7CXasKfctL-XvL827tA_it2t=Q@mail.gmail.com>
Date:   Wed, 18 Oct 2017 18:34:33 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Samuel Thibault <samuel.thibault@...-lyon.org>,
        Dmitry Fleytman <dmitry@...nix.com>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: usb/core: slab-out-of-bounds in usb_get_bos_descriptor

On Wed, Oct 18, 2017 at 5:25 PM, Alan Stern <stern@...land.harvard.edu> wrote:
> On Wed, 18 Oct 2017, Andrey Konovalov wrote:
>
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit 3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11 (4.14-rc5+).
>>
>> Looks like usb_get_bos_descriptor() doesn't check that buffer has
>> enough space for usb_dev_cap_header, which causes out-of-bounds
>> accesses.
>
> Please try the patch below.
>
> Alan Stern

Hi Alan,

This patch fixes the issue.

Thanks!

Tested-by: Andrey Konovalov <andreyknvl@...gle.com>

>
>
>
> Index: usb-4.x/drivers/usb/core/config.c
> ===================================================================
> --- usb-4.x.orig/drivers/usb/core/config.c
> +++ usb-4.x/drivers/usb/core/config.c
> @@ -952,10 +952,12 @@ int usb_get_bos_descriptor(struct usb_de
>         for (i = 0; i < num; i++) {
>                 buffer += length;
>                 cap = (struct usb_dev_cap_header *)buffer;
> -               length = cap->bLength;
>
> -               if (total_len < length)
> +               if (total_len < sizeof(*cap) || total_len < cap->bLength) {
> +                       dev->bos->desc->bNumDeviceCaps = i;
>                         break;
> +               }
> +               length = cap->bLength;
>                 total_len -= length;
>
>                 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
>