usbvision: fix overflow of interfaces array (CVE-2015-7833)
This commit is contained in:
parent
95b8f8213b
commit
222755c823
|
@ -1,3 +1,9 @@
|
||||||
|
linux (4.2.5-2) UNRELEASED; urgency=medium
|
||||||
|
|
||||||
|
* usbvision: fix overflow of interfaces array (CVE-2015-7833)
|
||||||
|
|
||||||
|
-- Ben Hutchings <ben@decadent.org.uk> Sun, 08 Nov 2015 14:47:40 +0000
|
||||||
|
|
||||||
linux (4.2.5-1) unstable; urgency=medium
|
linux (4.2.5-1) unstable; urgency=medium
|
||||||
|
|
||||||
* New upstream stable update:
|
* New upstream stable update:
|
||||||
|
|
|
@ -0,0 +1,31 @@
|
||||||
|
From: Oliver Neukum <oneukum@suse.com>
|
||||||
|
Date: Tue, 27 Oct 2015 12:42:38 +0100
|
||||||
|
Subject: usbvision fix overflow of interfaces array
|
||||||
|
Origin: https://bugzilla.novell.com/attachment.cgi?id=653350
|
||||||
|
|
||||||
|
This fixes the crash reported in:
|
||||||
|
http://seclists.org/bugtraq/2015/Oct/35
|
||||||
|
The interface number needs a sanity check.
|
||||||
|
|
||||||
|
Signed-off-by: Oliver Neukum <oneukum@suse.com>
|
||||||
|
[bwh: Backported to 4.2: adjust context]
|
||||||
|
---
|
||||||
|
drivers/media/usb/usbvision/usbvision-video.c | 7 +++++++
|
||||||
|
1 file changed, 7 insertions(+)
|
||||||
|
|
||||||
|
--- a/drivers/media/usb/usbvision/usbvision-video.c
|
||||||
|
+++ b/drivers/media/usb/usbvision/usbvision-video.c
|
||||||
|
@@ -1533,6 +1533,13 @@ static int usbvision_probe(struct usb_in
|
||||||
|
printk(KERN_INFO "%s: %s found\n", __func__,
|
||||||
|
usbvision_device_data[model].model_string);
|
||||||
|
|
||||||
|
+ /*
|
||||||
|
+ * this is a security check.
|
||||||
|
+ * an exploit using an incorrect bInterfaceNumber is known
|
||||||
|
+ */
|
||||||
|
+ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
|
||||||
|
+ return -ENODEV;
|
||||||
|
+
|
||||||
|
if (usbvision_device_data[model].interface >= 0)
|
||||||
|
interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
|
||||||
|
else
|
|
@ -104,3 +104,4 @@ bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
|
||||||
|
|
||||||
debian/target-fix-abi-change-in-4.2.4.patch
|
debian/target-fix-abi-change-in-4.2.4.patch
|
||||||
debian/signal-fix-abi-change-in-4.2.4.patch
|
debian/signal-fix-abi-change-in-4.2.4.patch
|
||||||
|
bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
|
||||||
|
|
Loading…
Reference in New Issue