[linux] 01/01: [x86] USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit d1dddc0e3cdbb7356689fb35313d0a067a766ecb
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu Apr 21 22:22:32 2016 +0200

    [x86] USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
---
 debian/changelog                                   |  4 ++
 ...B-usbip-fix-potential-out-of-bounds-write.patch | 46 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 51 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 1898b5c..d0bbcb9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,14 @@
 linux (3.16.7-ckt25-2+deb8u1) UNRELEASED; urgency=medium
 
+  [ Ben Hutchings ]
   * include/linux/poison.h: fix LIST_POISON{1,2} offset (CVE-2016-0821)
   * [s390*] mm: four page table levels vs. fork (CVE-2016-2143)
   * [amd64] iopl: Properly context-switch IOPL on Xen PV (CVE-2016-3157)
   * [amd64] entry/compat: Add missing CLAC to entry_INT80_32 (CVE-2016-XXXX)
 
+  [ Salvatore Bonaccorso ]
+  * [x86] USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
+
  -- Ben Hutchings <ben at decadent.org.uk>  Wed, 30 Mar 2016 16:32:07 +0100
 
 linux (3.16.7-ckt25-2) jessie; urgency=medium
diff --git a/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch b/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
new file mode 100644
index 0000000..41c8fcf
--- /dev/null
+++ b/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
@@ -0,0 +1,46 @@
+From: Ignat Korchagin <ignat.korchagin at gmail.com>
+Date: Thu, 17 Mar 2016 18:00:29 +0000
+Subject: USB: usbip: fix potential out-of-bounds write
+Origin: https://git.kernel.org/linus/b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb
+
+Fix potential out-of-bounds write to urb->transfer_buffer
+usbip handles network communication directly in the kernel. When receiving a
+packet from its peer, usbip code parses headers according to protocol. As
+part of this parsing urb->actual_length is filled. Since the input for
+urb->actual_length comes from the network, it should be treated as untrusted.
+Any entity controlling the network may put any value in the input and the
+preallocated urb->transfer_buffer may not be large enough to hold the data.
+Thus, the malicious entity is able to write arbitrary data to kernel memory.
+
+Signed-off-by: Ignat Korchagin <ignat.korchagin at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+[carnil: backport for 3.16: context: driver still in staging area]
+---
+ drivers/staging/usbip/usbip_common.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
+index facaaf0..e40da77 100644
+--- a/drivers/staging/usbip/usbip_common.c
++++ b/drivers/staging/usbip/usbip_common.c
+@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ 	if (!(size > 0))
+ 		return 0;
+ 
++	if (size > urb->transfer_buffer_length) {
++		/* should not happen, probably malicious packet */
++		if (ud->side == USBIP_STUB) {
++			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++			return 0;
++		} else {
++			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++			return -EPIPE;
++		}
++	}
++
+ 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
+ 	if (ret != size) {
+ 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
+-- 
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index ad3b78c..4082922 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -663,3 +663,4 @@ bugfix/all/include-linux-poison.h-fix-list_poison-1-2-offset.patch
 bugfix/s390/s390-mm-four-page-table-levels-vs.-fork.patch
 bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
 bugfix/x86/x86-entry-compat-add-missing-clac-to-entry_int80_32.patch
+bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git