ACK: [CVE-2017-12762][Trusty][SRU][PATCH 1/1] isdn/i4l: fix buffer overflow
Khaled Elmously
khalid.elmously at canonical.com
Fri Feb 9 04:41:51 UTC 2018
On 2018-02-02 14:44:48 , Po-Hsu Lin wrote:
> From: Annie Cherkaev <annie.cherk at gmail.com>
>
> CVE-2017-12762
>
> This fixes a potential buffer overflow in isdn_net.c caused by an
> unbounded strcpy.
>
> [ ISDN seems to be effectively unmaintained, and the I4L driver in
> particular is long deprecated, but in case somebody uses this..
> - Linus ]
>
> Signed-off-by: Jiten Thakkar <jitenmt at gmail.com>
> Signed-off-by: Annie Cherkaev <annie.cherk at gmail.com>
> Cc: Karsten Keil <isdn at linux-pingi.de>
> Cc: Kees Cook <keescook at chromium.org>
> Cc: stable at kernel.org
> Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
> (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin at canonical.com>
> ---
> drivers/isdn/i4l/isdn_common.c | 1 +
> drivers/isdn/i4l/isdn_net.c | 5 ++---
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
> index 9bb12ba..dc16b9c 100644
> --- a/drivers/isdn/i4l/isdn_common.c
> +++ b/drivers/isdn/i4l/isdn_common.c
> @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
> if (arg) {
> if (copy_from_user(bname, argp, sizeof(bname) - 1))
> return -EFAULT;
> + bname[sizeof(bname)-1] = 0;
> } else
> return -EINVAL;
> ret = mutex_lock_interruptible(&dev->mtx);
> diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
> index 8b98d53..ea51ae3 100644
> --- a/drivers/isdn/i4l/isdn_net.c
> +++ b/drivers/isdn/i4l/isdn_net.c
> @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm)
> char newname[10];
>
> if (p) {
> - /* Slave-Name MUST not be empty */
> - if (!strlen(p + 1))
> + /* Slave-Name MUST not be empty or overflow 'newname' */
> + if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
> return NULL;
> - strcpy(newname, p + 1);
> *p = 0;
> /* Master must already exist */
> if (!(n = isdn_net_findif(parm)))
Acked-by: Khalid Elmously <khalid.elmously at canonical.com>
More information about the kernel-team
mailing list