kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/usbip
History
Ignat Korchagin 9a71843e3a USB: usbip: fix potential out-of-bounds write 
[ Upstream commit b348d7dddb ]

Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-07-12 08:47:50 -04:00
..
Kconfig usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
Makefile usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
README usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
stub.h usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
stub_dev.c usbip: remove struct usb_device_id table 2014-08-25 10:40:58 -07:00
stub_main.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
stub_rx.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
stub_tx.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
usbip_common.c USB: usbip: fix potential out-of-bounds write 2016-07-12 08:47:50 -04:00
usbip_common.h usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
usbip_event.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
usbip_protocol.txt usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
vhci.h usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
vhci_hcd.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
vhci_rx.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
vhci_sysfs.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
vhci_tx.c usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00

README 

TODO:
	- more discussion about the protocol
	- testing
	- review of the userspace interface
	- document the protocol

Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>