From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: "Charles (Chas) Williams" <ciwillia@brocade.com>
Cc: stable@vger.kernel.org, Kangjie Lu <kangjielu@gmail.com>,
Kangjie Lu <kjlu@gatech.edu>
Subject: Re: [PATCH 3.14.y 5/9] USB: usbfs: fix potential infoleak in devio
Date: Sun, 14 Aug 2016 16:44:00 +0200 [thread overview]
Message-ID: <20160814144400.GC27230@kroah.com> (raw)
In-Reply-To: <1468875203-10816-5-git-send-email-ciwillia@brocade.com>
On Mon, Jul 18, 2016 at 04:53:19PM -0400, Charles (Chas) Williams wrote:
> From: Kangjie Lu <kangjielu@gmail.com>
>
> commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.
>
> The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
> are padding bytes which are not initialized and leaked to userland
> via “copy_to_user”.
>
> CVE-2016-4482
>
> Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> [ciwillia@brocade.com: backported to 3.14: adjusted context]
> Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com>
> ---
> drivers/usb/core/devio.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
Another one not in 4.4 :(
next prev parent reply other threads:[~2016-08-14 14:43 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-18 20:53 [PATCH 3.14.y 1/9] udp: properly support MSG_PEEK with truncated buffers Charles (Chas) Williams
2016-07-18 20:53 ` [PATCH 3.14.y 2/9] USB: fix invalid memory access in hub_activate() Charles (Chas) Williams
2016-07-18 20:53 ` [PATCH 3.14.y 3/9] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Charles (Chas) Williams
2016-08-14 14:43 ` Greg KH
2016-08-14 14:52 ` Bjørn Mork
2016-08-14 15:05 ` Greg KH
2016-07-18 20:53 ` [PATCH 3.14.y 4/9] KEYS: potential uninitialized variable Charles (Chas) Williams
2016-07-18 20:53 ` [PATCH 3.14.y 5/9] USB: usbfs: fix potential infoleak in devio Charles (Chas) Williams
2016-08-14 14:44 ` Greg Kroah-Hartman [this message]
2016-08-15 14:41 ` Charles (Chas) Williams
2016-07-18 20:58 ` [PATCH 3.14.y 6/9] mm: migrate dirty page without clear_page_dirty_for_io etc Charles (Chas) Williams
2016-07-18 20:59 ` [PATCH 3.14.y 7/9] printk: do cond_resched() between lines while outputting to consoles Charles (Chas) Williams
2016-07-18 20:59 ` [PATCH 3.14.y 8/9] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Charles (Chas) Williams
2016-07-18 20:59 ` [PATCH 3.14.y 9/9] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Charles (Chas) Williams
2016-08-14 14:42 ` [PATCH 3.14.y 1/9] udp: properly support MSG_PEEK with truncated buffers Greg KH
2016-08-15 7:21 ` Michal Kubecek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160814144400.GC27230@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=ciwillia@brocade.com \
--cc=kangjielu@gmail.com \
--cc=kjlu@gatech.edu \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox