ACK: [CVE-2017-12762][Trusty][SRU][PATCH 1/1] isdn/i4l: fix buffer overflow

Khaled Elmously khalid.elmously at canonical.com
Fri Feb 9 04:41:51 UTC 2018


On 2018-02-02 14:44:48 , Po-Hsu Lin wrote:
> From: Annie Cherkaev <annie.cherk at gmail.com>
> 
> CVE-2017-12762
> 
> This fixes a potential buffer overflow in isdn_net.c caused by an
> unbounded strcpy.
> 
> [ ISDN seems to be effectively unmaintained, and the I4L driver in
>   particular is long deprecated, but in case somebody uses this..
>     - Linus ]
> 
> Signed-off-by: Jiten Thakkar <jitenmt at gmail.com>
> Signed-off-by: Annie Cherkaev <annie.cherk at gmail.com>
> Cc: Karsten Keil <isdn at linux-pingi.de>
> Cc: Kees Cook <keescook at chromium.org>
> Cc: stable at kernel.org
> Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
> (cherry picked from commit 9f5af546e6acc30f075828cb58c7f09665033967)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin at canonical.com>
> ---
>  drivers/isdn/i4l/isdn_common.c | 1 +
>  drivers/isdn/i4l/isdn_net.c    | 5 ++---
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
> index 9bb12ba..dc16b9c 100644
> --- a/drivers/isdn/i4l/isdn_common.c
> +++ b/drivers/isdn/i4l/isdn_common.c
> @@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
>  			if (arg) {
>  				if (copy_from_user(bname, argp, sizeof(bname) - 1))
>  					return -EFAULT;
> +				bname[sizeof(bname)-1] = 0;
>  			} else
>  				return -EINVAL;
>  			ret = mutex_lock_interruptible(&dev->mtx);
> diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
> index 8b98d53..ea51ae3 100644
> --- a/drivers/isdn/i4l/isdn_net.c
> +++ b/drivers/isdn/i4l/isdn_net.c
> @@ -2643,10 +2643,9 @@ isdn_net_newslave(char *parm)
>  	char newname[10];
>  
>  	if (p) {
> -		/* Slave-Name MUST not be empty */
> -		if (!strlen(p + 1))
> +		/* Slave-Name MUST not be empty or overflow 'newname' */
> +		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
>  			return NULL;
> -		strcpy(newname, p + 1);
>  		*p = 0;
>  		/* Master must already exist */
>  		if (!(n = isdn_net_findif(parm)))

Acked-by: Khalid Elmously <khalid.elmously at canonical.com>





More information about the kernel-team mailing list