On Mon, Feb 14, 2022 at 12:32:42PM +0100, Jann Horn wrote:
> commit 57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 upstream.
>
> ax88179_rx_fixup() contains several out-of-bounds accesses that can be
> triggered by a malicious (or defective) USB device, in particular:
>
> - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds,
> causing OOB reads and (on big-endian systems) OOB endianness flips.
> - A packet can overlap the metadata array, causing a later OOB
> endianness flip to corrupt data used by a cloned SKB that has already
> been handed off into the network stack.
> - A packet SKB can be constructed whose tail is far beyond its end,
> causing out-of-bounds heap data to be considered part of the SKB's
> data.
>
> I have tested that this can be used by a malicious USB device to send a
> bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response
> that contains random kernel heap data.
> It's probably also possible to get OOB writes from this on a
> little-endian system somehow - maybe by triggering skb_cow() via IP
> options processing -, but I haven't tested that.
>
> Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
> Cc: stable@xxxxxxxxxx
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> ---
> drivers/net/usb/ax88179_178a.c | 68 +++++++++++++++++++---------------
> 1 file changed, 39 insertions(+), 29 deletions(-)
Now queued up, thanks.
greg k-h
