diff options
| author | Kees Cook <keescook@chromium.org> | 2013-09-11 21:56:51 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-10-01 09:10:51 -0700 |
| commit | b77d6514bc7631d95528e63989dbb11d97c7c115 (patch) | |
| tree | 20b20722862f2f44c65904325a4e29785e8bd1a6 /fs/jbd2/commit.c | |
| parent | 0049b62c9efc4ef23492976512d4722b3e63de45 (diff) | |
HID: zeroplus: validate output report details
commit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream.
The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:
[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten
CVE-2013-2889
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/jbd2/commit.c')
0 files changed, 0 insertions, 0 deletions