diff --git a/debian/changelog b/debian/changelog index 7ec58dc6a..4ff2810ff 100644 --- a/debian/changelog +++ b/debian/changelog @@ -127,6 +127,7 @@ linux (4.13.13-1) UNRELEASED; urgency=medium * usb: usbtest: fix NULL pointer dereference (CVE-2017-16532) * media: cx231xx-cards: fix NULL-deref on missing association descriptor (CVE-2017-16536) + * media: imon: Fix null-ptr-deref in imon_probe (CVE-2017-16537) -- Salvatore Bonaccorso Sat, 04 Nov 2017 09:54:41 +0100 diff --git a/debian/patches/bugfix/all/media-imon-fix-null-ptr-deref-in-imon_probe.patch b/debian/patches/bugfix/all/media-imon-fix-null-ptr-deref-in-imon_probe.patch new file mode 100644 index 000000000..40b26ad3d --- /dev/null +++ b/debian/patches/bugfix/all/media-imon-fix-null-ptr-deref-in-imon_probe.patch @@ -0,0 +1,31 @@ +From: Arvind Yadav +Date: Mon, 9 Oct 2017 20:14:48 +0200 +Subject: media: imon: Fix null-ptr-deref in imon_probe +Origin: https://git.kernel.org/linus/58fd55e838276a0c13d1dc7c387f90f25063cbf3 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16537 + +It seems that the return value of usb_ifnum_to_if() can be NULL and +needs to be checked. + +Signed-off-by: Arvind Yadav +Tested-by: Andrey Konovalov +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +--- + drivers/media/rc/imon.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -2516,6 +2516,11 @@ static int imon_probe(struct usb_interfa + mutex_lock(&driver_lock); + + first_if = usb_ifnum_to_if(usbdev, 0); ++ if (!first_if) { ++ ret = -ENODEV; ++ goto fail; ++ } ++ + first_if_ctx = usb_get_intfdata(first_if); + + if (ifnum == 0) { diff --git a/debian/patches/series b/debian/patches/series index 56461ce42..0b0b13ca2 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -119,6 +119,7 @@ bugfix/all/mac80211-don-t-compare-tkip-tx-mic-key-in-reinstall-.patch bugfix/all/sctp-do-not-peel-off-an-assoc-from-one-netns-to-anot.patch bugfix/all/usb-usbtest-fix-NULL-pointer-dereference.patch bugfix/all/media-cx231xx-cards-fix-null-deref-on-missing-associ.patch +bugfix/all/media-imon-fix-null-ptr-deref-in-imon_probe.patch # Fix exported symbol versions bugfix/alpha/alpha-restore-symbol-versions-for-symbols-exported-f.patch