Szymon Heidrich
c7dd13805f
usb: rndis_host: Secure rndis_query check against int overflow
...
Variables off and len typed as uint32 in rndis_query function
are controlled by incoming RNDIS response message thus their
value may be manipulated. Setting off to a unexpectetly large
value will cause the sum with len and 8 to overflow and pass
the implemented validation step. Consequently the response
pointer will be referring to a location past the expected
buffer boundaries allowing information leakage e.g. via
RNDIS_OID_802_3_PERMANENT_ADDRESS OID.
Fixes: ddda086240 ("USB: rndis_host, various cleanups")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
2023-01-03 09:24:41 +00:00
..
2022-12-16 13:04:15 -06:00
2022-12-15 10:21:10 -08:00
2022-12-13 15:22:14 -08:00
2022-12-13 10:54:19 -08:00
2022-12-19 12:33:32 -06:00
2022-12-21 08:41:32 -08:00
2022-12-13 15:47:48 -08:00
2022-12-16 03:49:24 -08:00
2022-12-20 03:13:45 +01:00
2022-12-13 13:46:07 -08:00
2022-12-12 12:52:02 -08:00
2022-12-12 16:39:38 -08:00
2022-12-19 07:13:33 -06:00
2022-12-19 07:13:33 -06:00
2022-12-08 13:03:47 -08:00
2022-12-05 21:57:20 +09:00
2022-12-19 08:54:17 -06:00
2022-12-16 03:54:54 -08:00
2022-12-12 15:40:03 +01:00
2022-12-16 03:49:24 -08:00
2022-12-20 03:13:45 +01:00
2022-12-16 03:49:24 -08:00
2022-12-15 09:45:51 -08:00
2022-12-16 03:54:54 -08:00
2022-12-16 03:54:54 -08:00
2022-12-13 15:47:48 -08:00
2022-12-13 13:09:38 -08:00
2022-12-15 14:47:10 -08:00
2022-12-11 21:25:58 +01:00
2022-12-16 03:49:24 -08:00
2022-12-17 08:23:42 -06:00
2022-12-16 03:54:54 -08:00
2022-12-19 08:34:39 -06:00
2022-12-14 15:23:49 -08:00
2022-12-21 08:41:32 -08:00
2022-12-17 08:28:25 -06:00
2022-12-12 13:38:17 -08:00
2022-12-13 10:58:09 -08:00
2022-12-16 03:54:54 -08:00
2022-12-13 15:22:14 -08:00
2022-12-09 10:29:58 +01:00
2022-12-19 07:13:33 -06:00
2022-12-13 13:41:26 -08:00
2022-12-13 12:32:07 -08:00
2023-01-03 09:24:41 +00:00
2022-12-14 20:51:29 -08:00
2022-12-21 08:41:32 -08:00
2022-12-16 03:49:24 -08:00
2022-12-20 08:48:24 -06:00
2022-12-17 23:19:38 +01:00
2022-12-19 08:40:58 -06:00
2022-12-14 15:23:49 -08:00
2022-12-19 08:40:58 -06:00
2022-12-13 13:03:06 -08:00
2022-12-16 03:22:53 -08:00
2022-12-17 08:39:31 -06:00
2022-12-13 15:47:48 -08:00
2022-12-11 19:30:20 -08:00
2022-12-13 12:49:59 -08:00
2022-12-15 23:34:31 +01:00
2022-12-28 12:10:42 +00:00
2022-12-21 08:41:32 -08:00
2022-12-19 16:07:59 -06:00
2022-12-19 08:47:33 -06:00
2022-12-13 12:54:31 -08:00
2022-12-16 03:49:24 -08:00
2022-12-14 08:58:51 -08:00
2022-12-12 10:17:08 -08:00
2022-12-15 10:16:04 -08:00
2022-12-16 03:54:54 -08:00
2022-12-14 08:58:51 -08:00
2022-12-21 08:41:32 -08:00
2022-12-16 03:54:54 -08:00
2022-12-14 20:01:51 +01:00
2022-12-16 03:49:24 -08:00
2022-12-17 08:34:01 -06:00
2022-12-13 11:59:58 -08:00