On Mon, Sep 19, 2016 at 07:09:51PM +0100, James wrote:
> From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
>
> This patch fixes a NULL pointer dereference caused by a race codition in the
> probe function of the legousbtower driver. It re-structures the probe
> function to only register the interface after successfully reading the
> board's firmware ID.
>
> The probe function does not deregister the usb interface after an error
> receiving the devices firmware ID. The device file registered
> (/dev/usb/legousbtower%d) may be read/written globally before the probe
> function returns. When tower_delete is called in the probe function
> (after an r/w has been initiated), core dev structures are deleted while
> the file operation functions are still running. If the 0 address is mappable
> on the machine, this vulnerability can be used to create a Local Priviege
> Escalation exploit via a write-what-where condition by remapping
> dev->interrupt_out_buffer in tower_write. A forged USB device and local
> program execution would be required for LPE. The USB
> device would have to delay the control message in tower_probe and accept
> the control urb in tower_open whilst guest code initiated a write to the
> device file as tower_delete is called from the error in tower_probe.
>
> This bug has existed since 2003. Patch tested by emulated device.
>
> Reported-by: James Patrick-Evans <james@xxxxxxxxx>
> Tested-by: James Patrick-Evans <james@xxxxxxxxx>
> Signed-off-by: James Patrick-Evans <james@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
> drivers/usb/misc/legousbtower.c | 35 +++++++++++++++++------------------
> 1 file changed, 17 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
> index 7771be3..4dd531a 100644
> --- a/drivers/usb/misc/legousbtower.c
> +++ b/drivers/usb/misc/legousbtower.c
> @@ -898,24 +898,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
> dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
> dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
>
> - /* we can register the device now, as it is ready */
> - usb_set_intfdata (interface, dev);
> -
> - retval = usb_register_dev (interface, &tower_class);
> -
> - if (retval) {
> - /* something prevented us from registering this driver */
> - dev_err(idev, "Not able to get a minor for this device.\n");
> - usb_set_intfdata (interface, NULL);
> - goto error;
> - }
> - dev->minor = interface->minor;
> -
> - /* let the user know what node this device is now attached to */
> - dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
> - "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
> - USB_MAJOR, dev->minor);
> -
> /* get the firmware version and log it */
> result = usb_control_msg (udev,
> usb_rcvctrlpipe(udev, 0),
> @@ -936,6 +918,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
> get_version_reply.minor,
> le16_to_cpu(get_version_reply.build_no));
>
> + /* we can register the device now, as it is ready */
> + usb_set_intfdata (interface, dev);
> +
> + retval = usb_register_dev (interface, &tower_class);
> +
> + if (retval) {
> + /* something prevented us from registering this driver */
> + dev_err(idev, "Not able to get a minor for this device.\n");
> + usb_set_intfdata (interface, NULL);
> + goto error;
> + }
> + dev->minor = interface->minor;
> +
> + /* let the user know what node this device is now attached to */
> + dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
> + "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
> + USB_MAJOR, dev->minor);
>
> exit:
> return retval;
> --
Ugh, all of the tabs got turned into spaces, next time be more careful
with your email client :(
thanks,
greg k-h
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html