From 07803ad12e6fcc5367f8107ea04eae9af0846fc0 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Tue, 13 Sep 2016 13:47:11 +0200 Subject: kernel: CVE-2016-3136 Crash on invalid USB device descriptors (mct_u232 driver) Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3136 Reference to upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/?id=f9dbb3666b3ddb5f9a7e44a433383cb6880a03f5 Signen-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau --- recipes-kernel/linux/linux-ls1/CVE-2016-3136.patch | 52 ++++++++++++++++++++++ recipes-kernel/linux/linux-ls1_3.12.bbappend | 1 + 2 files changed, 53 insertions(+) create mode 100644 recipes-kernel/linux/linux-ls1/CVE-2016-3136.patch diff --git a/recipes-kernel/linux/linux-ls1/CVE-2016-3136.patch b/recipes-kernel/linux/linux-ls1/CVE-2016-3136.patch new file mode 100644 index 0000000..6821435 --- /dev/null +++ b/recipes-kernel/linux/linux-ls1/CVE-2016-3136.patch @@ -0,0 +1,52 @@ +From f9dbb3666b3ddb5f9a7e44a433383cb6880a03f5 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 31 Mar 2016 12:04:24 -0400 +Subject: USB: mct_u232: add sanity checking in probe + +commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream. + +An attack using the lack of sanity checking in probe is known. This +patch checks for the existence of a second port. + +CVE: CVE-2016-3136 +Upstream-Status: Backport + +Signed-off-by: Oliver Neukum +[johan: add error message ] +Signed-off-by: Johan Hovold +Signed-off-by: Jiri Slaby +Signed-off-by: Sona Sarmadi +--- + drivers/usb/serial/mct_u232.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index 6a15adf..c14c29f 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -377,14 +377,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, + + static int mct_u232_port_probe(struct usb_serial_port *port) + { ++ struct usb_serial *serial = port->serial; + struct mct_u232_private *priv; + ++ /* check first to simplify error handling */ ++ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { ++ dev_err(&port->dev, "expected endpoint missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + /* Use second interrupt-in endpoint for reading. */ +- priv->read_urb = port->serial->port[1]->interrupt_in_urb; ++ priv->read_urb = serial->port[1]->interrupt_in_urb; + priv->read_urb->context = port; + + spin_lock_init(&priv->lock); +-- +cgit v0.12 + diff --git a/recipes-kernel/linux/linux-ls1_3.12.bbappend b/recipes-kernel/linux/linux-ls1_3.12.bbappend index b04933d..8bc21d4 100644 --- a/recipes-kernel/linux/linux-ls1_3.12.bbappend +++ b/recipes-kernel/linux/linux-ls1_3.12.bbappend @@ -7,6 +7,7 @@ SRC_URI += "file://ls1021aiot.dts \ file://0002-watchdog-fix-errata-err004346.patch \ file://ppp-CVE-2015-8569.patch \ file://net-CVE-2016-5696.patch \ + file://CVE-2016-3136.patch \ " # fix err: "linux-ls1-3.12-r0 do_deploy: Taskhash mismatch" -- cgit v1.2.3-54-g00ecf