lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2024090427-trident-delegator-0781@gregkh>
Date: Wed, 4 Sep 2024 16:13:03 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Edward Adam Davis <eadavis@...com>
Cc: syzbot+9d34f80f841e948c3fdb@...kaller.appspotmail.com,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH] USB: usbtmc: prevent kernel-infoleak

On Wed, Sep 04, 2024 at 04:09:15PM +0200, Greg KH wrote:
> On Wed, Sep 04, 2024 at 09:55:43PM +0800, Edward Adam Davis wrote:
> > The syzbot reported a kernel-usb-infoleak in usbtmc_write,
> > we need to clear the structure before filling fields.
> 
> Really?
> 
> 
> > 
> > Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write")
> > Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb
> > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > ---
> >  drivers/usb/class/usbtmc.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
> > index 6bd9fe565385..e9ddaa9b580d 100644
> > --- a/drivers/usb/class/usbtmc.c
> > +++ b/drivers/usb/class/usbtmc.c
> > @@ -759,6 +759,7 @@ static struct urb *usbtmc_create_urb(void)
> >  		usb_free_urb(urb);
> >  		return NULL;
> >  	}
> > +	memset(dmabuf, 0, bufsize);
> 
> To do this simpler, kzmalloc() above this would be nice.
> 
> But, this feels odd, where is the data leaking from?  This is used for
> both the read and write path, but where is the leak happening?  A short
> read?  If so, we need to properly truncate the buffer being sent to
> userspace and not send the unread data.  If a short write, that makes no
> sense.

I looked at the report and this seems to be data sent to the device, so
somehow we aren't setting the length to send to the device correctly.

Good luck!

greg k-h

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ