From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755440AbdCTPFH (ORCPT ); Mon, 20 Mar 2017 11:05:07 -0400 Received: from mx2.suse.de ([195.135.220.15]:53839 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753771AbdCTPFB (ORCPT ); Mon, 20 Mar 2017 11:05:01 -0400 Message-ID: <1490022247.25734.6.camel@suse.com> Subject: Re: [PATCH v2 2/4] cdc-acm: fix possible invalid access when processing notification From: Oliver Neukum To: Tobias Herzog Cc: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org Date: Mon, 20 Mar 2017 16:04:07 +0100 In-Reply-To: <1489863159-10972-3-git-send-email-t-herzog@gmx.de> References: <1479118868.21146.4.camel@suse.com> <1489863159-10972-1-git-send-email-t-herzog@gmx.de> <1489863159-10972-3-git-send-email-t-herzog@gmx.de> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Am Samstag, den 18.03.2017, 19:52 +0100 schrieb Tobias Herzog: > Notifications may only be 8 bytes so long. Accessing the 9th and > 10th byte of unimplemented/unknown notifications may be insecure. > Also check the length of known notifications before accessing anything > behind the 8th byte. > This is fixing a potential security issue. Please make it first in the series and CC it to stable@vger.kernel.org Regards Oliver