From: Greg Kroah-Hartman <greg@kroah.com>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kees Cook <keescook@chromium.org>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 01/26] b43: stop format string leaking into error msgs
Date: Tue, 18 Jun 2013 09:14:41 -0700 [thread overview]
Message-ID: <20130618161231.466154808@linuxfoundation.org> (raw)
In-Reply-To: <20130618161231.154881788@linuxfoundation.org>
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit e0e29b683d6784ef59bbc914eac85a04b650e63c upstream.
The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.
CVE-2013-2852
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/b43/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2449,7 +2449,7 @@ static void b43_request_firmware(struct
for (i = 0; i < B43_NR_FWTYPES; i++) {
errmsg = ctx->errors[i];
if (strlen(errmsg))
- b43err(dev->wl, errmsg);
+ b43err(dev->wl, "%s", errmsg);
}
b43_print_fw_helptext(dev->wl, 1);
goto out;
next prev parent reply other threads:[~2013-06-18 16:14 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-18 16:14 [ 00/26] 3.4.50-stable review Greg Kroah-Hartman
2013-06-18 16:14 ` Greg Kroah-Hartman [this message]
2013-06-18 16:14 ` [ 02/26] libceph: must hold mutex for reset_changed_osds() Greg Kroah-Hartman
2013-06-18 16:14 ` [ 03/26] ceph: add cpu_to_le32() calls when encoding a reconnect capability Greg Kroah-Hartman
2013-06-18 16:14 ` [ 04/26] ceph: ceph_pagelist_append might sleep while atomic Greg Kroah-Hartman
2013-06-18 16:14 ` [ 05/26] drivers/rtc/rtc-twl.c: fix missing device_init_wakeup() when booted with device tree Greg Kroah-Hartman
2013-06-18 16:14 ` [ 06/26] drm/gma500/psb: Unpin framebuffer on crtc disable Greg Kroah-Hartman
2013-06-18 16:14 ` [ 07/26] drm/gma500/cdv: " Greg Kroah-Hartman
2013-06-18 16:14 ` [ 08/26] Bluetooth: Fix mgmt handling of power on failures Greg Kroah-Hartman
2013-06-18 16:14 ` [ 09/26] ath9k: Disable PowerSave by default Greg Kroah-Hartman
2013-06-18 16:14 ` [ 10/26] ath9k: Use minstrel rate control " Greg Kroah-Hartman
2013-06-18 16:14 ` [ 11/26] CPU hotplug: provide a generic helper to disable/enable CPU hotplug Greg Kroah-Hartman
2013-06-18 16:14 ` [ 12/26] reboot: rigrate shutdown/reboot to boot cpu Greg Kroah-Hartman
2013-06-18 16:14 ` [ 13/26] cciss: fix broken mutex usage in ioctl Greg Kroah-Hartman
2013-06-18 16:14 ` [ 14/26] drm/i915: prefer VBT modes for SVDO-LVDS over EDID Greg Kroah-Hartman
2013-06-18 16:14 ` [ 15/26] swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion Greg Kroah-Hartman
2013-06-18 16:14 ` [ 16/26] md/raid1: consider WRITE as successful only if at least one non-Faulty and non-rebuilding drive completed it Greg Kroah-Hartman
2013-06-18 16:14 ` [ 17/26] mm: migration: add migrate_entry_wait_huge() Greg Kroah-Hartman
2013-06-18 16:14 ` [ 18/26] x86: Fix typo in kexec register clearing Greg Kroah-Hartman
2013-06-18 16:14 ` [ 19/26] libceph: clear messenger auth_retry flag when we authenticate Greg Kroah-Hartman
2013-06-18 16:15 ` [ 20/26] libceph: fix authorizer invalidation Greg Kroah-Hartman
2013-06-18 16:15 ` [ 21/26] libceph: add update_authorizer auth method Greg Kroah-Hartman
2013-06-18 16:15 ` [ 22/26] libceph: wrap auth ops in wrapper functions Greg Kroah-Hartman
2013-06-18 16:15 ` [ 23/26] libceph: wrap auth methods in a mutex Greg Kroah-Hartman
2013-06-18 16:15 ` [ 24/26] ceph: fix statvfs fr_size Greg Kroah-Hartman
2013-06-18 16:15 ` [ 25/26] powerpc: Fix stack overflow crash in resume_kernel when ftracing Greg Kroah-Hartman
2013-06-18 16:15 ` [ 26/26] powerpc: Fix missing/delayed calls to irq_work Greg Kroah-Hartman
[not found] ` <CAKocOOOnfMbYymOamd8Woy=tmjnQ1i9xGLx-U2Unj8j7sk2RQA@mail.gmail.com>
2013-06-18 22:23 ` [ 00/26] 3.4.50-stable review Shuah Khan
2013-06-20 10:53 ` Satoru Takeuchi
2013-06-20 16:59 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130618161231.466154808@linuxfoundation.org \
--to=greg@kroah.com \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox