Re: Lack of length checking in USB configuration may allow buffer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 13 May 2019, Rick Mark wrote:

> Hey All,
> 
> I was seeing a linux VM crash due to malformed USB configuration
> payloads being malformed.

Can you provide more information about this crash?  I would like to 
know exactly what errors are occurring.  As far as I can tell, the 
existing code already tests for all the things your patch adds.

>  I'm testing this patch now which should
> provide better security checking (but this is my first patch so be
> kind if I have things wrong.)

Have you read the loop in usb_parse_configuration() that starts at 
the comment:

	/* Go through the descriptors, checking their length and counting the
	 * number of altsettings for each interface */

(approximately line 585)?  This loop should carry out all the tests
that your patch is trying to duplicate.

Alan Stern




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux