oss-security - CVE Request: Linux kernel: remote buffer overflow in usbip

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160419080643.GA26432@suse.de>
Date: Tue, 19 Apr 2016 10:06:43 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Cc: security@...nel.org
Subject: CVE Request: Linux kernel: remote buffer overflow in usbip

Hi,

https://github.com/torvalds/linux/commit/b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb

commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb
Author: Ignat Korchagin <ignat.korchagin@...il.com>
Date:   Thu Mar 17 18:00:29 2016 +0000

    USB: usbip: fix potential out-of-bounds write

    Fix potential out-of-bounds write to urb->transfer_buffer
    usbip handles network communication directly in the kernel. When receiving a
    packet from its peer, usbip code parses headers according to protocol. As
    part of this parsing urb->actual_length is filled. Since the input for
    urb->actual_length comes from the network, it should be treated as untrusted.
    Any entity controlling the network may put any value in the input and the
    preallocated urb->transfer_buffer may not be large enough to hold the data.
    Thus, the malicious entity is able to write arbitrary data to kernel memory.

    Signed-off-by: Ignat Korchagin <ignat.korchagin@...il.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index facaaf0..e40da77 100644
--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
        if (!(size > 0))
                return 0;

+       if (size > urb->transfer_buffer_length) {
+               /* should not happen, probably malicious packet */
+               if (ud->side == USBIP_STUB) {
+                       usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+                       return 0;
+               } else {
+                       usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+                       return -EPIPE;
+               }
+       }
+
        ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
        if (ret != size) {
                dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);

Our USB developer confirms:
https://bugzilla.suse.com/show_bug.cgi?id=975945
|The vulnerability is true. If an attacker can get a malicious package
|into the connection the kernel will accept all of the data in that
|package whether it fits into the buffer or not.
|You can scribble about 1k into RAM, albeit at an unpredictable location.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.