diff options
| author | Kees Cook <keescook@chromium.org> | 2013-09-11 21:56:51 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2013-10-26 21:06:04 +0100 |
| commit | e0f897f0929d27dc5d7de5cc24ccbeac572e5176 (patch) | |
| tree | 8eb4ed9c2c00b2e09dbcde082cf1c4c71327b5a6 /scripts/patch-kernel | |
| parent | 9c8ea9f2d66ff437dd25da392a104947c703d975 (diff) | |
HID: zeroplus: validate output report details
commit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream.
The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:
[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten
CVE-2013-2889
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions