kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/usb
History
Hui Peng 2d955f32f4 USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data 
commit 5146f95df7 upstream.

The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.

Add a length check for both locations and updated hso_probe to bail on
error.

This issue has been assigned CVE-2018-19985.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-03-25 17:32:32 +00:00
..
asix.h drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
asix_common.c asix: Check for supported Wake-on-LAN modes 2018-12-16 22:09:28 +00:00
asix_devices.c asix: Do full reset during ax88772_bind 2015-10-19 11:20:24 +01:00
ax88172a.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ax88179_178a.c ax88179_178a: Check for supported Wake-on-LAN modes 2018-12-16 22:09:29 +00:00
catc.c catc: Use heap buffer for memory size test 2017-03-16 02:27:10 +00:00
cdc-phonet.c net: cdc-phonet: Staticize usbpn_probe 2013-09-20 14:41:02 -04:00
cdc_eem.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
cdc_ether.c net: cdc_ether: fix divide by 0 on bad descriptors 2017-11-26 13:50:39 +00:00
cdc_mbim.c net: cdc_ncm/cdc_mbim: adding NCM protocol statistics 2014-05-16 22:39:01 -04:00
cdc_ncm.c cdc_ncm: workaround for EM7455 "silent" data interface 2017-03-16 02:27:18 +00:00
cdc_subset.c Revert "cdc_subset: deal with a device that needs reset for timeout" 2014-07-30 08:56:23 -07:00
cx82310_eth.c cx82310_eth: use skb_cow_head() to deal with cloned skbs 2017-07-18 18:40:38 +01:00
dm9601.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-01-18 00:55:41 -08:00
gl620a.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
hso.c USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data 2019-03-25 17:32:32 +00:00
huawei_cdc_ncm.c net: huawei_cdc_ncm: add "subclass 3" devices 2014-07-17 16:49:50 -07:00
int51x1.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ipheth.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-06-03 23:32:12 -07:00
kalmia.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
kaweth.c net: get rid of SET_ETHTOOL_OPS 2014-05-13 17:43:20 -04:00
Kconfig USB2NET: Fix Default to 'y' for SR9800 Device Driver, setting to 'n' 2014-02-13 18:42:01 -05:00
lg-vl600.c lg-vl600: Convert uses of __constant_<foo> to <foo> 2014-03-12 15:28:06 -04:00
Makefile r8152: disable the ECM mode 2014-03-05 20:40:24 -05:00
mcs7830.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
net1080.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
pegasus.c pegasus: Use heap buffers for all register access 2017-03-16 02:27:10 +00:00
pegasus.h drivers: net: usb: pegasus: fix control urb submission 2013-04-29 13:57:50 -04:00
plusb.c usb: plusb: Add support for National Instruments host-to-host cable 2015-03-12 16:27:46 +00:00
qmi_wwan.c qmi_wwan: do not steal interfaces from class drivers 2018-10-21 08:45:52 +01:00
r8152.c r8152: Check for supported Wake-on-LAN Modes 2018-12-16 22:09:29 +00:00
rndis_host.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
rtl8150.c rtl8150: Use heap buffers for all register access 2017-03-16 02:27:10 +00:00
sierra_net.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
smsc75xx.c smsc75xx: Check for Wake-on-LAN modes 2018-12-16 22:09:30 +00:00
smsc75xx.h usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
smsc95xx.c smsc95xx: Check for Wake-on-LAN modes 2018-12-16 22:09:30 +00:00
smsc95xx.h usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
sr9700.c sr9700: use skb_cow_head() to deal with cloned skbs 2017-07-18 18:40:38 +01:00
sr9700.h USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support 2013-09-03 22:26:03 -04:00
sr9800.c sr9800: Check for supported Wake-on-LAN modes 2018-12-16 22:09:29 +00:00
sr9800.h USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support 2014-02-10 16:53:06 -08:00
usbnet.c usbnet: cleanup after bind() in probe() 2016-05-01 00:06:10 +02:00
zaurus.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00