[linux] 01/01: USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch wheezy-security
in repository linux.

commit ca9106c1052b2d8d00664af6ae9cf4a7d8e183a7
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu Apr 21 22:22:32 2016 +0200

    USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
---
 debian/changelog                                   |  4 +++
 ...B-usbip-fix-potential-out-of-bounds-write.patch | 41 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 46 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 98eceb0..c4338a7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,13 @@
 linux (3.2.78-1+deb7u1) UNRELEASED; urgency=medium
 
+  [ Ben Hutchings ]
   * include/linux/poison.h: fix LIST_POISON{1,2} offset (CVE-2016-0821)
   * [s390*] mm: four page table levels vs. fork (CVE-2016-2143)
   * [amd64] iopl: Properly context-switch IOPL on Xen PV (CVE-2016-3157)
 
+  [ Salvatore Bonaccorso ]
+  * [x86] USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
+
  -- Ben Hutchings <ben at decadent.org.uk>  Wed, 30 Mar 2016 16:16:32 +0100
 
 linux (3.2.78-1) wheezy; urgency=medium
diff --git a/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch b/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
new file mode 100644
index 0000000..f539310
--- /dev/null
+++ b/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
@@ -0,0 +1,41 @@
+From: Ignat Korchagin <ignat.korchagin at gmail.com>
+Date: Thu, 17 Mar 2016 18:00:29 +0000
+Subject: USB: usbip: fix potential out-of-bounds write
+Origin: https://git.kernel.org/linus/b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb
+
+Fix potential out-of-bounds write to urb->transfer_buffer
+usbip handles network communication directly in the kernel. When receiving a
+packet from its peer, usbip code parses headers according to protocol. As
+part of this parsing urb->actual_length is filled. Since the input for
+urb->actual_length comes from the network, it should be treated as untrusted.
+Any entity controlling the network may put any value in the input and the
+preallocated urb->transfer_buffer may not be large enough to hold the data.
+Thus, the malicious entity is able to write arbitrary data to kernel memory.
+
+Signed-off-by: Ignat Korchagin <ignat.korchagin at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+[carnil: backport for 3.2: context; and driver still in staging area]
+---
+ drivers/staging/usbip/usbip_common.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/staging/usbip/usbip_common.c
++++ b/drivers/staging/usbip/usbip_common.c
+@@ -820,6 +820,17 @@ int usbip_recv_xbuff(struct usbip_device
+ 	if (!(size > 0))
+ 		return 0;
+ 
++	if (size > urb->transfer_buffer_length) {
++		/* should not happen, probably malicious packet */
++		if (ud->side == USBIP_STUB) {
++			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++			return 0;
++		} else {
++			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++			return -EPIPE;
++		}
++	}
++
+ 	ret = usbip_xmit(0, ud->tcp_socket, (char *)urb->transfer_buffer,
+ 			 size, 0);
+ 	if (ret != size) {
diff --git a/debian/patches/series b/debian/patches/series
index 2fd13c3..88ea968 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1173,3 +1173,4 @@ bugfix/all/revert-crypto-algif_skcipher-do-not-dereference-ctx-.patch
 bugfix/all/include-linux-poison.h-fix-list_poison-1-2-offset.patch
 bugfix/s390/s390-mm-four-page-table-levels-vs.-fork.patch
 bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
+bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git