diff options
author | Andreas Wellving <andreas.wellving@enea.com> | 2018-10-26 13:37:44 +0200 |
---|---|---|
committer | Andreas Wellving <andreas.wellving@enea.com> | 2018-10-26 13:37:44 +0200 |
commit | 588a9af2bd15ab9a86cd9672293e9c8942964c1a (patch) | |
tree | f5cced501cab0c25c37749c6dbb44d7bd7705314 | |
parent | a8c6ff94fd3905f1a35a189b510aac1bfddc883a (diff) | |
download | enea-kernel-cache-588a9af2bd15ab9a86cd9672293e9c8942964c1a.tar.gz |
video: CVE-2018-13406
video: uvesafb: Fix integer overflow in allocation
Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7673ca3c93414faf90fa2a3c339f1f625415fecb
Change-Id: Ice9a6ab8a1e042fd32d1fe6a049855156ae4246b
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
-rw-r--r-- | patches/cve/4.9.x.scc | 3 | ||||
-rw-r--r-- | patches/cve/CVE-2018-13406-video-uvesafb-Fix-integer-overflow-in-allocation.patch | 41 |
2 files changed, 44 insertions, 0 deletions
diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc index e4346d5..96a5b31 100644 --- a/patches/cve/4.9.x.scc +++ b/patches/cve/4.9.x.scc | |||
@@ -12,3 +12,6 @@ SRC_URI += "file://CVE-2018-9415-ARM-amba-Fix-race-condition-with-driver_overrid | |||
12 | 12 | ||
13 | #CVEs fixed in 4.9.99: | 13 | #CVEs fixed in 4.9.99: |
14 | SRC_URI += "file://CVE-2017-18255-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch" | 14 | SRC_URI += "file://CVE-2017-18255-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch" |
15 | |||
16 | #CVEs fixed in 4.9.111: | ||
17 | SRC_URI += "file://CVE-2018-13406-video-uvesafb-Fix-integer-overflow-in-allocation.patch" | ||
diff --git a/patches/cve/CVE-2018-13406-video-uvesafb-Fix-integer-overflow-in-allocation.patch b/patches/cve/CVE-2018-13406-video-uvesafb-Fix-integer-overflow-in-allocation.patch new file mode 100644 index 0000000..e0b643b --- /dev/null +++ b/patches/cve/CVE-2018-13406-video-uvesafb-Fix-integer-overflow-in-allocation.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From 7673ca3c93414faf90fa2a3c339f1f625415fecb Mon Sep 17 00:00:00 2001 | ||
2 | From: Kees Cook <keescook@chromium.org> | ||
3 | Date: Fri, 11 May 2018 18:24:12 +1000 | ||
4 | Subject: [PATCH] video: uvesafb: Fix integer overflow in allocation | ||
5 | |||
6 | commit 9f645bcc566a1e9f921bdae7528a01ced5bc3713 upstream. | ||
7 | |||
8 | cmap->len can get close to INT_MAX/2, allowing for an integer overflow in | ||
9 | allocation. This uses kmalloc_array() instead to catch the condition. | ||
10 | |||
11 | Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com> | ||
12 | Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core") | ||
13 | Cc: stable@vger.kernel.org | ||
14 | |||
15 | CVE: CVE-2018-13406 | ||
16 | Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7673ca3c93414faf90fa2a3c339f1f625415fecb] | ||
17 | |||
18 | Signed-off-by: Kees Cook <keescook@chromium.org> | ||
19 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
20 | Signed-off-by: Andreas Wellving <andreas.wellving@enea.com> | ||
21 | --- | ||
22 | drivers/video/fbdev/uvesafb.c | 3 ++- | ||
23 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c | ||
26 | index 98af9e02959b..9fe0d0bcdf62 100644 | ||
27 | --- a/drivers/video/fbdev/uvesafb.c | ||
28 | +++ b/drivers/video/fbdev/uvesafb.c | ||
29 | @@ -1059,7 +1059,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info) | ||
30 | info->cmap.len || cmap->start < info->cmap.start) | ||
31 | return -EINVAL; | ||
32 | |||
33 | - entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL); | ||
34 | + entries = kmalloc_array(cmap->len, sizeof(*entries), | ||
35 | + GFP_KERNEL); | ||
36 | if (!entries) | ||
37 | return -ENOMEM; | ||
38 | |||
39 | -- | ||
40 | 2.19.1 | ||
41 | |||