kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/video
History
Peter Malone b57ed0f08e fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). 
commit 250c6c49e3 upstream.

Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
sbusfb_ioctl_helper().

'index' is defined as an int in sbusfb_ioctl_helper().
We retrieve this from the user:
if (get_user(index, &c->index) ||
    __get_user(count, &c->count) ||
    __get_user(ured, &c->red) ||
    __get_user(ugreen, &c->green) ||
    __get_user(ublue, &c->blue))
       return -EFAULT;

and then we use 'index' in the following way:
red = cmap->red[index + i] >> 8;
green = cmap->green[index + i] >> 8;
blue = cmap->blue[index + i] >> 8;

This is a classic information leak vulnerability. 'index' should be
an unsigned int, given its usage above.

This patch is straight-forward; it changes 'index' to unsigned int
in two switch-cases: FBIOGETCMAP_SPARC && FBIOPUTCMAP_SPARC.

This patch fixes CVE-2018-6412.

Signed-off-by: Peter Malone <peter.malone@gmail.com>
Acked-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-06-16 22:21:32 +01:00
..
backlight backlight: lm3630a: Bump REG_MAX value to 0x50 instead of 0x1F 2017-11-26 13:50:13 +00:00
console framebuffer: fix border color 2014-11-17 14:11:46 +00:00
fbdev fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). 2018-06-16 22:21:32 +01:00
logo video/logo: prevent use of logos after they have been freed 2015-01-16 14:34:19 +00:00
display_timing.c video: add display_timing and videomode 2013-01-24 09:03:04 +01:00
hdmi.c video/hdmi: Rename HDMI_IDENTIFIER to HDMI_IEEE_OUI 2013-08-30 08:42:01 +10:00
Kconfig gpu: ipu-v3: Move i.MX IPUv3 core driver out of staging 2014-06-04 11:06:52 +02:00
Makefile fbdev: sti: don't select CONFIG_VT 2017-08-26 02:14:46 +01:00
of_display_timing.c video: of: display_timing: fix default native-mode setting 2014-05-23 13:31:19 +03:00
of_videomode.c videomode: videomode_from_timing work 2013-03-21 14:34:33 +02:00
vgastate.c vga: vgastate fix 2007-05-08 11:15:32 -07:00
videomode.c videomode: videomode_from_timing work 2013-03-21 14:34:33 +02:00