Alan Stern 48a4ff1c7b USB: core: prevent malicious bNumInterfaces overflow ...

A malicious USB device with crafted descriptors can cause the kernel
to access unallocated memory by setting the bNumInterfaces value too
high in a configuration descriptor.  Although the value is adjusted
during parsing, this adjustment is skipped in one of the error return
paths.

This patch prevents the problem by setting bNumInterfaces to 0
initially.  The existing code already sets it to the proper value
after parsing is complete.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-12-13 12:28:43 +01:00

..

buffer.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

config.c

USB: core: prevent malicious bNumInterfaces overflow

2017-12-13 12:28:43 +01:00

devices.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

devio.c

USB: usbfs: Filter flags passed in from user space

2017-11-28 15:17:48 +01:00

driver.c

usb: core: introduce a new usb_get_std_status() helper

2017-11-07 15:47:19 +01:00

endpoint.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

file.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

generic.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

hcd-pci.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

hcd.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

hub.c

usb: hub: Cycle HUB power when initialization fails

2017-11-28 15:17:49 +01:00

hub.h

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

Kconfig

docs-rst: fix usb cross-references

2017-04-11 14:41:29 -06:00

ledtrig-usbport.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

message.c

usb: core: message: remember to reset 'ret' to 0 when necessary

2017-11-09 13:02:23 +01:00

notify.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

of.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

otg_whitelist.h

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

port.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

quirks.c

usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub

2017-11-28 15:17:49 +01:00

sysfs.c

Merge tag 'usb-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2017-11-13 21:14:07 -08:00

urb.c

Merge tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2017-11-14 18:01:46 -08:00

usb-acpi.c

USB: core: Remove redundant license text

2017-11-04 11:55:39 +01:00

usb.c

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00

usb.h

USB: core: move existing SPDX tags to top of the file

2017-11-03 10:12:26 +01:00