lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20241012100801.1774302-1-shipeiqu@sjtu.edu.cn>
Date: Sat, 12 Oct 2024 18:07:56 +0800
From: itewqq <shipeiqu@...u.edu.cn>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>,
	ye xingchen <ye.xingchen@....com.cn>,
	itewqq <shipeiqu@...u.edu.cn>,
	Al Viro <viro@...iv.linux.org.uk>
Cc: linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] Input/mouse: cyapa - fix stack overflow bug in cyapa_gen3_get_query_data

The i2c_smbus_read_block_data function receives up to I2C_SMBUS_BLOCK_MAX
bytes. which is typically 32. This exceeds the size of the local variable
(u8 query_data[QUERY_DATA_SIZE]) in cyapa_gen3_get_query_data, which is
provided to cyapa_read_block and finally reach i2c_smbus_read_block_data.
When the cyapa module is enabled (CONFIG_MOUSE_CYAPA=m), this bug could
cause denial-of-service (or potentially code execution). For example, by a
physical attacker who can hijack I2C communications or plant malicious
firmware in the Cyapa peripheral. To fix this bug, this patch change the
size of query_data from QUERY_DATA_SIZE to I2C_SMBUS_BLOCK_MAX.

Signed-off-by: itewqq <shipeiqu@...u.edu.cn>
---
 drivers/input/mouse/cyapa_gen3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/cyapa_gen3.c b/drivers/input/mouse/cyapa_gen3.c
index fc3fb954523b..6a5ffff51922 100644
--- a/drivers/input/mouse/cyapa_gen3.c
+++ b/drivers/input/mouse/cyapa_gen3.c
@@ -980,7 +980,7 @@ static int cyapa_gen3_set_proximity(struct cyapa *cyapa, bool enable)
 
 static int cyapa_gen3_get_query_data(struct cyapa *cyapa)
 {
-	u8 query_data[QUERY_DATA_SIZE];
+	u8 query_data[I2C_SMBUS_BLOCK_MAX];
 	int ret;
 
 	if (cyapa->state != CYAPA_STATE_OP)
-- 
2.30.2


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ