summaryrefslogtreecommitdiffstats
path: root/recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch')
-rw-r--r--recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch43
1 files changed, 0 insertions, 43 deletions
diff --git a/recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch b/recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch
deleted file mode 100644
index e4eadff..0000000
--- a/recipes-kernel/linux/files/HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch
+++ /dev/null
@@ -1,43 +0,0 @@
1From 41df7f6d43723deb7364340b44bc5d94bf717456 Mon Sep 17 00:00:00 2001
2From: Kees Cook <keescook@chromium.org>
3Date: Wed, 11 Sep 2013 21:56:53 +0200
4Subject: [PATCH] HID: steelseries: validate output report details
5
6A HID device could send a malicious output report that would cause the
7steelseries HID driver to write beyond the output report allocation
8during initialization, causing a heap overflow:
9
10[ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410
11...
12[ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten
13
14CVE-2013-2891
15
16Signed-off-by: Kees Cook <keescook@chromium.org>
17Cc: stable@vger.kernel.org
18Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
19Signed-off-by: Jiri Kosina <jkosina@suse.cz>
20Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
21---
22 drivers/hid/hid-steelseries.c | 5 +++++
23 1 file changed, 5 insertions(+)
24
25diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
26index d164911..29f328f 100644
27--- a/drivers/hid/hid-steelseries.c
28+++ b/drivers/hid/hid-steelseries.c
29@@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
30 goto err_free;
31 }
32
33+ if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
34+ ret = -ENODEV;
35+ goto err_free;
36+ }
37+
38 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
39 if (ret) {
40 hid_err(hdev, "hw start failed\n");
41--
421.7.9.5
43