From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Young Xiao" <YangX92@hotmail.com>,
"Marcel Holtmann" <marcel@holtmann.org>
Subject: [PATCH 3.16 06/10] Bluetooth: hidp: fix buffer overflow
Date: Tue, 18 Jun 2019 15:28:02 +0100 [thread overview]
Message-ID: <lsq.1560868082.707403898@decadent.org.uk> (raw)
In-Reply-To: <lsq.1560868079.359853905@decadent.org.uk>
3.16.69-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Young Xiao <YangX92@hotmail.com>
commit a1616a5ac99ede5d605047a9012481ce7ff18b16 upstream.
Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.
This vulnerability is similar to CVE-2011-1079.
Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/bluetooth/hidp/sock.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -76,6 +76,7 @@ static int hidp_sock_ioctl(struct socket
sockfd_put(csock);
return err;
}
+ ca.name[sizeof(ca.name)-1] = 0;
err = hidp_connection_add(&ca, csock, isock);
if (!err && copy_to_user(argp, &ca, sizeof(ca)))
next prev parent reply other threads:[~2019-06-18 14:29 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-18 14:27 [PATCH 3.16 00/10] 3.16.69-rc1 review Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 05/10] ext4: zero out the unused memory region in the extent tree block Ben Hutchings
2019-06-18 14:28 ` Ben Hutchings [this message]
2019-06-18 14:28 ` [PATCH 3.16 10/10] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 08/10] tcp: tcp_fragment() should apply sane memory limits Ben Hutchings
2019-07-02 2:51 ` Florian Fainelli
2019-07-05 14:54 ` Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 02/10] mm/mincore.c: make mincore() more conservative Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 07/10] tcp: limit payload size of sacked skbs Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 01/10] mm: introduce vma_is_anonymous(vma) helper Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 04/10] scsi: megaraid_sas: return error when create DMA pool failed Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 09/10] tcp: add tcp_min_snd_mss sysctl Ben Hutchings
2019-06-18 14:28 ` [PATCH 3.16 03/10] drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl Ben Hutchings
2019-06-19 21:58 ` [PATCH 3.16 00/10] 3.16.69-rc1 review Guenter Roeck
2019-06-19 22:02 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1560868082.707403898@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=YangX92@hotmail.com \
--cc=akpm@linux-foundation.org \
--cc=kda@linux-powerpc.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox