usbvision: fix overflow of interfaces array (CVE-2015-7833)
This commit is contained in:
parent
95b8f8213b
commit
222755c823
|
@ -1,3 +1,9 @@
|
|||
linux (4.2.5-2) UNRELEASED; urgency=medium
|
||||
|
||||
* usbvision: fix overflow of interfaces array (CVE-2015-7833)
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Sun, 08 Nov 2015 14:47:40 +0000
|
||||
|
||||
linux (4.2.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream stable update:
|
||||
|
|
|
@ -0,0 +1,31 @@
|
|||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: Tue, 27 Oct 2015 12:42:38 +0100
|
||||
Subject: usbvision fix overflow of interfaces array
|
||||
Origin: https://bugzilla.novell.com/attachment.cgi?id=653350
|
||||
|
||||
This fixes the crash reported in:
|
||||
http://seclists.org/bugtraq/2015/Oct/35
|
||||
The interface number needs a sanity check.
|
||||
|
||||
Signed-off-by: Oliver Neukum <oneukum@suse.com>
|
||||
[bwh: Backported to 4.2: adjust context]
|
||||
---
|
||||
drivers/media/usb/usbvision/usbvision-video.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
--- a/drivers/media/usb/usbvision/usbvision-video.c
|
||||
+++ b/drivers/media/usb/usbvision/usbvision-video.c
|
||||
@@ -1533,6 +1533,13 @@ static int usbvision_probe(struct usb_in
|
||||
printk(KERN_INFO "%s: %s found\n", __func__,
|
||||
usbvision_device_data[model].model_string);
|
||||
|
||||
+ /*
|
||||
+ * this is a security check.
|
||||
+ * an exploit using an incorrect bInterfaceNumber is known
|
||||
+ */
|
||||
+ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
|
||||
+ return -ENODEV;
|
||||
+
|
||||
if (usbvision_device_data[model].interface >= 0)
|
||||
interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
|
||||
else
|
|
@ -104,3 +104,4 @@ bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
|
|||
|
||||
debian/target-fix-abi-change-in-4.2.4.patch
|
||||
debian/signal-fix-abi-change-in-4.2.4.patch
|
||||
bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
|
||||
|
|
Loading…
Reference in New Issue