From 27c0f9d843ec651f5f4452c826ac3be6e353c017 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 1 Dec 2015 14:55:42 -0500 Subject: [PATCH] CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) --- kernel.spec | 6 +++ ...ash-on-detecting-device-with-invalid.patch | 49 +++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 usbvision-fix-crash-on-detecting-device-with-invalid.patch diff --git a/kernel.spec b/kernel.spec index c861fd9bd..3f556896b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -626,6 +626,9 @@ Patch565: Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch #rhbz 1284059 Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch +#CVE-2015-7833 rhbz 1270158 1270160 +Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch + # END OF PATCH DEFINITIONS %endif @@ -2069,6 +2072,9 @@ fi # # %changelog +* Tue Dec 01 2015 Josh Boyer +- CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) + * Mon Nov 30 2015 Josh Boyer - Fix crash in add_key (rhbz 1284059) - CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) diff --git a/usbvision-fix-crash-on-detecting-device-with-invalid.patch b/usbvision-fix-crash-on-detecting-device-with-invalid.patch new file mode 100644 index 000000000..a03e37907 --- /dev/null +++ b/usbvision-fix-crash-on-detecting-device-with-invalid.patch @@ -0,0 +1,49 @@ +From 2ea39fc263c6a7589e15edb7d2d1c89fa569be53 Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Mon, 16 Nov 2015 15:55:11 -0200 +Subject: [PATCH] usbvision: fix crash on detecting device with invalid + configuration + +The usbvision driver crashes when a specially crafted usb device with invalid +number of interfaces or endpoints is detected. This fix adds checks that the +device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg +Signed-off-by: Vladis Dronov +Signed-off-by: Mauro Carvalho Chehab +--- + drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index b693206f66dd..d1dc1a198e3e 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf, + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); +-- +2.5.0 +