leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5146f95df7
linux/drivers/net/usb
History
Hui Peng 5146f95df7 USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data 
The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.

Add a length check for both locations and updated hso_probe to bail on
error.

This issue has been assigned CVE-2018-19985.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-12 15:41:10 -08:00
..
asix_common.c asix: Check for supported Wake-on-LAN modes 2018-09-29 11:31:29 -07:00
asix_devices.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux 2018-07-20 21:17:12 -07:00
asix.h asix: Fix small memory leak in ax88772_unbind() 2017-08-07 10:10:19 -07:00
ax88172a.c
ax88179_178a.c ax88179_178a: Check for supported Wake-on-LAN modes 2018-09-29 11:31:29 -07:00
catc.c net: usb: Mark expected switch fall-throughs 2018-06-30 20:47:16 +09:00
cdc_eem.c net: cdc_eem: clean up bind error path 2018-03-07 15:39:27 -05:00
cdc_ether.c cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN 2018-04-11 10:36:38 -04:00
cdc_mbim.c net: usb: cdc_mbim: add flag FLAG_SEND_ZLP 2018-06-01 14:01:42 -04:00
cdc_ncm.c net: cdc_ncm: remove set but not used variable 'ctx' 2018-10-12 09:45:36 -07:00
cdc_subset.c
cdc-phonet.c net: usb: Mark expected switch fall-throughs 2018-06-30 20:47:16 +09:00
ch9200.c
cx82310_eth.c
dm9601.c
gl620a.c
hso.c USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data 2018-12-12 15:41:10 -08:00
huawei_cdc_ncm.c cdc_ncm: Set NTB format again after altsetting switch for Huawei devices 2017-07-14 08:15:05 -07:00
int51x1.c net: introduce __skb_put_[zero, data, u8] 2017-06-20 13:30:14 -04:00
ipheth.c usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 2018-11-27 14:57:16 -08:00
kalmia.c net: kalmia: clean up bind error path 2018-03-07 15:39:27 -05:00
kaweth.c net: usb: kaweth: use irqsave() in USB's complete callback 2018-06-22 13:57:45 +09:00
Kconfig lan78xx: Lan7801 Support for Fixed PHY 2018-04-29 21:41:01 -04:00
lan78xx.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-03 21:00:17 -07:00
lan78xx.h net: lan78xx: Switch to SPDX identifier 2018-09-05 22:20:45 -07:00
lg-vl600.c net: drivers/net: Remove unnecessary skb_copy_expand OOM messages 2018-03-15 14:28:03 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mcs7830.c
net1080.c networking: add and use skb_put_u8() 2017-06-16 11:48:40 -04:00
pegasus.c net: usb: pegasus: Replace mdelay() with msleep() in setup_pegasus_II() 2018-07-27 13:45:15 -07:00
pegasus.h
plusb.c
qmi_wwan.c qmi_wwan: Added support for Gemalto's Cinterion ALASxx WWAN interface 2018-10-10 22:57:23 -07:00
r8152.c r8152: Check for supported Wake-on-LAN Modes 2018-09-29 11:31:29 -07:00
rndis_host.c rndis_host: support Novatel Verizon USB730L 2017-10-03 14:30:46 -07:00
rtl8150.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux 2018-07-20 21:17:12 -07:00
sierra_net.c net: usb: Convert timers to use timer_setup() 2017-10-18 12:40:26 +01:00
smsc75xx.c net/usb: cancel pending work when unbinding smsc75xx 2018-10-04 13:51:30 -07:00
smsc75xx.h
smsc95xx.c net: smsc95xx: Fix MTU range 2018-11-08 19:54:49 -08:00
smsc95xx.h
sr9700.c net: usb: sr9700: Replace mdelay() with msleep() in sr9700_bind() 2018-07-27 13:45:15 -07:00
sr9700.h
sr9800.c sr9800: Check for supported Wake-on-LAN modes 2018-09-29 11:31:29 -07:00
sr9800.h
usbnet.c net: usbnet: make driver_info const 2018-10-02 22:22:46 -07:00
zaurus.c networking: add and use skb_put_u8() 2017-06-16 11:48:40 -04:00