Re: [PATCH v2] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers

Jimmy Assarsson
2025-11-03T08:51:23Z

On 10/29/25 20:06, Seungjin Bae wrote:
> Hello Jimmy,
>
> Thank you for trying to reproduce the issue and for the detailed
> explanation of the firmware logic.
>
> You are correct that this issue would not occur with the standard Kvaser
> firmware. The vulnerability I reported wasn’t found by running code
> on an actual Kvaser device.
>
> Instead, I discovered this issue by performing analysis on the driver
> code using a symbolic execution tool. This tool demonstrated that
> the driver contains a vulnerable code path.
>
> My goal was to show that if a malicious device is connected—one that
> sends a specifically crafted packet sequence not normally produced by
> the firmware—the driver code will process it incorrectly and cause
> the kernel panic.
>
> So regretfully, I don’t have any hardware information yet.

Sorry, I overlooked the title, and assumed this was a problem you had
encountered with a real device.

Patch LGTM and tested OK with actual Kvaser devices:
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>

Thanks!
/jimmy

> Thank you for your precious time.
>
> Best,
> Seungjin Bae
>
> 2025년 10월 29일 (수) 오전 6:53, Jimmy Assarsson <extja@kvaser.com
> <mailto:extja@kvaser.com>>님이 작성:
>
> On 10/26/25 14:26, Jimmy Assarsson wrote:
> > Hi Seungjin,
> >
> > Thanks for fixing this!
> > I'll do some testing in the beginning of next week.
> > Which Kvaser device did you use when you discovered the problem?
> >
> > Best regards,
> > jimmy
>
> Hi Seungjin,
>
> I've not been able to reproduce this problem, when testing with the
> latest firmware on multiple different devices.
>
> If the next command in the firmware packet queue, doesn't fit within the
> current endpoint transaction (wMaxPacketSize), the firmware will
> terminate the transaction with a zero byte. The driver then interprets
> this as a zero-length command, and skip to the next transaction.
>
> The firmware is responsible to insert a "zero termination byte" only
> when there is already one or more packets in the current transaction.
> Since all commands have even lengths (4,8,10,12,16,20,24,30,32 bytes)
> and the wMaxPacketSize is also even (64 bytes or 512 bytes, depending on
> the device), I cannot see a situation where the zero termination byte
> would be inserted exactly at the wMaxPacketSize boundary.
>
> Can you please provide which Kvaser device and firmware you use:
>    lsusb -d 0bfd:
>    ethtool -i can0
>
> Best regards,
> jimmy