linux-kernel - Re: [PATCH] rsi_usb: Fix out-of-bounds read in rsi_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87tugw0y1i.fsf@codeaurora.org>
Date:   Mon, 01 Nov 2021 16:07:37 +0200
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Zekun Shen <bruceshenzk@...il.com>
Cc:     Amitkumar Karwar <amitkarwar@...il.com>,
        Siva Rebbagondla <siva8118@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, brendandg@....edu
Subject: Re: [PATCH] rsi_usb: Fix out-of-bounds read in rsi_read_pkt

Zekun Shen <bruceshenzk@...il.com> writes:

> rsi_get_* functions rely on an offset variable from usb
> input. The size of usb input is RSI_MAX_RX_USB_PKT_SIZE(3000),
> while 2-byte offset can be up to 0xFFFF. Thus a large offset
> can cause out-of-bounds read.
>
> The patch adds a bound checking condition when rcv_pkt_len is 0,
> indicating it's USB. It's unclear whether this is triggerable
> from other type of bus. The following check might help in that case.
> offset > rcv_pkt_len - FRAME_DESC_SZ
>
> The bug is trigerrable with conpromised/malfunctioning USB devices.
> I tested the patch with the crashing input and got no more bug report.
>
> Attached is the KASAN report from fuzzing.
>
> BUG: KASAN: slab-out-of-bounds in rsi_read_pkt+0x42e/0x500 [rsi_91x]
> Read of size 2 at addr ffff888019439fdb by task RX-Thread/227
>
> CPU: 0 PID: 227 Comm: RX-Thread Not tainted 5.6.0 #66
> Call Trace:
>  dump_stack+0x76/0xa0
>  print_address_description.constprop.0+0x16/0x200
>  ? rsi_read_pkt+0x42e/0x500 [rsi_91x]
>  ? rsi_read_pkt+0x42e/0x500 [rsi_91x]
>  __kasan_report.cold+0x37/0x7c
>  ? rsi_read_pkt+0x42e/0x500 [rsi_91x]
>  kasan_report+0xe/0x20
>  rsi_read_pkt+0x42e/0x500 [rsi_91x]
>  rsi_usb_rx_thread+0x1b1/0x2fc [rsi_usb]
>  ? rsi_probe+0x16a0/0x16a0 [rsi_usb]
>  ? _raw_spin_lock_irqsave+0x7b/0xd0
>  ? _raw_spin_trylock_bh+0x120/0x120
>  ? __wake_up_common+0x10b/0x520
>  ? rsi_probe+0x16a0/0x16a0 [rsi_usb]
>  kthread+0x2b5/0x3b0
>  ? kthread_create_on_node+0xd0/0xd0
>  ret_from_fork+0x22/0x40
>
> Reported-by: Zekun Shen <bruceshenzk@...il.com>

You are the author, no need to have your name in Reported-by.


-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches