Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1374855 > unrolled thread

[PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 20:50 +0200
    Re: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB  descriptors Ben Hutchings <ben@decadent.org.uk> - 2016-04-12 03:40 +0200
      Re: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB  descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-12 16:30 +0200

#1374855 — [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors

4.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Josh Boyer <jwboyer@fedoraproject.org>

commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/iowarrior.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_in
 	iface_desc = interface->cur_altsetting;
 	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
+	if (iface_desc->desc.bNumEndpoints < 1) {
+		dev_err(&interface->dev, "Invalid number of endpoints\n");
+		retval = -EINVAL;
+		goto error;
+	}
+
 	/* set up the endpoint information */
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
 		endpoint = &iface_desc->endpoint[i].desc;

[toc] | [next] | [standalone]

#1376383 — Re: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors

[Multipart message — attachments visible in raw view] — view raw

On Sun, 2016-04-10 at 11:33 -0700, Greg Kroah-Hartman wrote:

> 4.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Josh Boyer <jwboyer@fedoraproject.org>
> 
> commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.
> 
> The iowarrior driver expects at least one valid endpoint.  If given
> malicious descriptors that specify 0 for the number of endpoints,
> it will crash in the probe function.  Ensure there is at least
> one endpoint on the interface before using it.
[...]

Which means our imaginary attacker will move on to providing a single
endpoint of the wrong type.  You've fixed the driver to reject the PoC
descriptor without thinking about what the driver actually requires.

I don't see the point of applying this to stable; it doesn't provide
any meaningful security benefit.

Ben.

-- 
Ben Hutchings
This sentence contradicts itself - no actually it doesn't.

[toc] | [prev] | [next] | [standalone]

#1376848 — Re: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors

On Tue, Apr 12, 2016 at 02:37:33AM +0100, Ben Hutchings wrote:
> On Sun, 2016-04-10 at 11:33 -0700, Greg Kroah-Hartman wrote:
> 
> > 4.5-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Josh Boyer <jwboyer@fedoraproject.org>
> > 
> > commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.
> > 
> > The iowarrior driver expects at least one valid endpoint.  If given
> > malicious descriptors that specify 0 for the number of endpoints,
> > it will crash in the probe function.  Ensure there is at least
> > one endpoint on the interface before using it.
> [...]
> 
> Which means our imaginary attacker will move on to providing a single
> endpoint of the wrong type.  You've fixed the driver to reject the PoC
> descriptor without thinking about what the driver actually requires.
> 
> I don't see the point of applying this to stable; it doesn't provide
> any meaningful security benefit.

Well, it's one hurdle down, but yes, it needs to be fixed "correctly"
Ideally all of these types of issues can be fixed in the USB core, I
just need to carve out some time to resolve them, but for now, let's
stay in sync with Linus's tree for this patch.

thanks,

greg k-h

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web