linux-kernel - [PATCH] media: dvb: fix a missing-check bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1538665177-17604-1-git-send-email-wang6495@umn.edu>
Date:   Thu,  4 Oct 2018 09:59:36 -0500
From:   Wenwen Wang <wang6495@....edu>
To:     Wenwen Wang <wang6495@....edu>
Cc:     Kangjie Lu <kjlu@....edu>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        linux-media@...r.kernel.org (open list:MEDIA INPUT INFRASTRUCTURE
        (V4L/DVB)), linux-kernel@...r.kernel.org (open list)
Subject: [PATCH] media: dvb: fix a missing-check bug

In dvb_video_write(), the first header byte of the buffer 'buf' supplied by
the user is checked to see whether 'buf' contains a TS packet, which
always starts with 0x47 for synchronization purposes. If yes, ts_play() is
called. Otherwise, dvb_play() will be called. Both of these two functions
will copy 'buf' again from the user space. However, no check is enforced
on the first byte of the copied content after the second copy. Since 'buf'
is in the user space, a malicious user can race to change the first byte
after the check in dvb_video_write() but before the second copy in
ts_play(). By doing so, the user can supply inconsistent data, which can
lead to undefined behavior in the driver.

This patch adds the required check in ts_play() to make sure the header
byte in the second copy is as expected. Otherwise an error code EINVAL will
be returned.

Signed-off-by: Wenwen Wang <wang6495@....edu>
---
 drivers/media/pci/ttpci/av7110_av.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c
index ef1bc17..1ff6062 100644
--- a/drivers/media/pci/ttpci/av7110_av.c
+++ b/drivers/media/pci/ttpci/av7110_av.c
@@ -468,6 +468,8 @@ static ssize_t ts_play(struct av7110 *av7110, const char __user *buf,
 		}
 		if (copy_from_user(kb, buf, TS_SIZE))
 			return -EFAULT;
+		if (kb[0] != 0x47)
+			return -EINVAL;
 		write_ts_to_decoder(av7110, type, kb, TS_SIZE);
 		todo -= TS_SIZE;
 		buf += TS_SIZE;
-- 
2.7.4