From: Dan Rosenberg <drosenberg@vsecurity.com>
To: gregkh@suse.de
Cc: security@kernel.org, linux-kernel@vger.kernel.org
Subject: Staging: vt6655/vt6656 security issues
Date: Mon, 27 Sep 2010 14:30:56 -0400 [thread overview]
Message-ID: <1285612256.10963.44.camel@dan> (raw)
Based on a brief glance looking for security issues, I just wanted to
mention that these drivers are nowhere near ready to be added to the
main kernel. I'm not interested in developing these drivers further,
but there are at least six stack buffer overflows:
vt6655/wpactl.c: wpa_set_keys(), line 239
vt6655/wpactl.c: wpa_set_keys(), line 280
vt6655/wpactl.c: wpa_set_associate(), line 770 (reported by Dan
Carpenter)
vt6656/wpactl.c: wpa_set_keys(), line 239
vt6656/wpactl.c: wpa_set_keys(), line 279
vt6656/wpactl.c: wpa_set_associate(), line 779
And four heap corruption issues due to integer overflow in the
allocation size:
vt6655/ioctl.c: private_ioctl(), line 329
vt6655/ioctl.c: private_ioctl(), line 625
vt6656/ioctl.c: private_ioctl(), line 326
vt6656/ioctl.c: private_ioctl(), line 615
They are all caused by unchecked copy_from_user() calls with
user-provided length fields or kmalloc() calls with arithmetic on
user-provided sizes. This kind of sloppiness suggests there are almost
certainly other major security issues in this code.
Regards,
Dan
next reply other threads:[~2010-09-27 18:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-27 18:30 Dan Rosenberg [this message]
2010-09-27 19:28 ` Staging: vt6655/vt6656 security issues Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1285612256.10963.44.camel@dan \
--to=drosenberg@vsecurity.com \
--cc=gregkh@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=security@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox