kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/firewire
History
Stefan Richter 88eadd913f firewire: net: guard against rx buffer overflows 
commit 667121ace9 upstream.

The IP-over-1394 driver firewire-net lacked input validation when
handling incoming fragmented datagrams.  A maliciously formed fragment
with a respectively large datagram_offset would cause a memcpy past the
datagram buffer.

So, drop any packets carrying a fragment with offset + length larger
than datagram_size.

In addition, ensure that
  - GASP header, unfragmented encapsulation header, or fragment
    encapsulation header actually exists before we access it,
  - the encapsulated datagram or fragment is of nonzero size.

Reported-by: Eyal Itkin <eyal.itkin@gmail.com>
Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com>
Fixes: CVE 2016-8633
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-11-20 01:17:37 +00:00
..
core-card.c IEEE 1394 (FireWire) subsystem updates post v3.4: 2012-05-24 12:57:47 -07:00
core-cdev.c firewire: cdev: prevent kernel stack leaking into ioctl arguments 2014-11-27 11:21:52 +00:00
core-device.c firewire: don't use PREPARE_DELAYED_WORK 2014-03-07 10:19:57 -05:00
core-iso.c firewire: core: fix multichannel IR with buffers larger than 2 GB 2012-06-17 19:35:26 +02:00
core-topology.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
core-transaction.c firewire: Enable remote DMA above 4 GB 2014-01-20 01:11:13 +01:00
core.h sound updates for 3.16-rc1 2014-06-04 09:08:25 -07:00
init_ohci1394_dma.c various: Fix spelling of "asynchronous" in comments. 2012-11-19 14:32:13 +01:00
Kconfig firewire: IEEE 1394 (FireWire) support should depend on HAS_DMA 2014-07-13 20:53:25 +02:00
Makefile ieee1394: move init_ohci1394_dma to drivers/firewire/ 2010-10-11 14:48:03 +02:00
net.c firewire: net: guard against rx buffer overflows 2016-11-20 01:17:37 +00:00
nosy-user.h firewire: nosy: endianess fixes and annotations 2010-07-27 11:04:11 +02:00
nosy.c firewire: remove use of __devinitdata 2012-11-28 12:40:42 -08:00
nosy.h firewire: nosy: misc cleanups 2010-07-27 11:04:10 +02:00
ohci.c firewire: ohci: fix JMicron JMB38x IT context discovery 2015-12-13 17:49:09 +00:00
ohci.h firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 2010-10-17 14:09:12 +02:00
sbp2.c firewire: don't use PREPARE_DELAYED_WORK 2014-03-07 10:19:57 -05:00