diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2016-09-13 13:47:18 +0200 |
---|---|---|
committer | Adrian Dudau <adrian.dudau@enea.com> | 2016-09-16 10:12:47 +0200 |
commit | 48a0d93e2e0f1a8a95eaac7c4c04bd768c366a7f (patch) | |
tree | b2edfc04b5a5a8dba1c45e2c3781e8056806d9b1 | |
parent | 208350505de2fd0c974b1af1ec072a5a36b27f1a (diff) | |
download | meta-enea-bsp-ppc-48a0d93e2e0f1a8a95eaac7c4c04bd768c366a7f.tar.gz |
kernel: CVE-2016-3136
Crash on invalid USB device descriptors (mct_u232 driver)
Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3136
Reference to upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/?id=f9dbb3666b3ddb5f9a7e44a433383cb6880a03f5
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
-rw-r--r-- | recipes-kernel/linux/files/CVE-2016-3136.patch | 52 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-qoriq_3.12.bbappend | 1 |
2 files changed, 53 insertions, 0 deletions
diff --git a/recipes-kernel/linux/files/CVE-2016-3136.patch b/recipes-kernel/linux/files/CVE-2016-3136.patch new file mode 100644 index 0000000..6821435 --- /dev/null +++ b/recipes-kernel/linux/files/CVE-2016-3136.patch | |||
@@ -0,0 +1,52 @@ | |||
1 | From f9dbb3666b3ddb5f9a7e44a433383cb6880a03f5 Mon Sep 17 00:00:00 2001 | ||
2 | From: Oliver Neukum <oneukum@suse.com> | ||
3 | Date: Thu, 31 Mar 2016 12:04:24 -0400 | ||
4 | Subject: USB: mct_u232: add sanity checking in probe | ||
5 | |||
6 | commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream. | ||
7 | |||
8 | An attack using the lack of sanity checking in probe is known. This | ||
9 | patch checks for the existence of a second port. | ||
10 | |||
11 | CVE: CVE-2016-3136 | ||
12 | Upstream-Status: Backport | ||
13 | |||
14 | Signed-off-by: Oliver Neukum <ONeukum@suse.com> | ||
15 | [johan: add error message ] | ||
16 | Signed-off-by: Johan Hovold <johan@kernel.org> | ||
17 | Signed-off-by: Jiri Slaby <jslaby@suse.cz> | ||
18 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
19 | --- | ||
20 | drivers/usb/serial/mct_u232.c | 9 ++++++++- | ||
21 | 1 file changed, 8 insertions(+), 1 deletion(-) | ||
22 | |||
23 | diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c | ||
24 | index 6a15adf..c14c29f 100644 | ||
25 | --- a/drivers/usb/serial/mct_u232.c | ||
26 | +++ b/drivers/usb/serial/mct_u232.c | ||
27 | @@ -377,14 +377,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, | ||
28 | |||
29 | static int mct_u232_port_probe(struct usb_serial_port *port) | ||
30 | { | ||
31 | + struct usb_serial *serial = port->serial; | ||
32 | struct mct_u232_private *priv; | ||
33 | |||
34 | + /* check first to simplify error handling */ | ||
35 | + if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { | ||
36 | + dev_err(&port->dev, "expected endpoint missing\n"); | ||
37 | + return -ENODEV; | ||
38 | + } | ||
39 | + | ||
40 | priv = kzalloc(sizeof(*priv), GFP_KERNEL); | ||
41 | if (!priv) | ||
42 | return -ENOMEM; | ||
43 | |||
44 | /* Use second interrupt-in endpoint for reading. */ | ||
45 | - priv->read_urb = port->serial->port[1]->interrupt_in_urb; | ||
46 | + priv->read_urb = serial->port[1]->interrupt_in_urb; | ||
47 | priv->read_urb->context = port; | ||
48 | |||
49 | spin_lock_init(&priv->lock); | ||
50 | -- | ||
51 | cgit v0.12 | ||
52 | |||
diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bbappend b/recipes-kernel/linux/linux-qoriq_3.12.bbappend index a963007..b06423d 100644 --- a/recipes-kernel/linux/linux-qoriq_3.12.bbappend +++ b/recipes-kernel/linux/linux-qoriq_3.12.bbappend | |||
@@ -6,5 +6,6 @@ SRC_URI += "file://ppp-CVE-2015-8569.patch \ | |||
6 | file://net-CVE-2015-8543.patch \ | 6 | file://net-CVE-2015-8543.patch \ |
7 | file://net-CVE-2016-2070.patch \ | 7 | file://net-CVE-2016-2070.patch \ |
8 | file://net-CVE-2016-5696.patch \ | 8 | file://net-CVE-2016-5696.patch \ |
9 | file://CVE-2016-3136.patch \ | ||
9 | " | 10 | " |
10 | 11 | ||