From 380a96f628fab2263cc12d72b15bf432a9528435 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 2 Dec 2015 12:21:40 +0100 Subject: media-ttusb-dec: CVE-2014-8884 Fixes buffer overflow in ioctl. Fix for linux-qoriq 3.12. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8884 Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/ ?id=482c6cb2dfb40838d67b0ba844b4b3d0af0f3d20 Signed-off-by: Sona Sarmadi Signed-off-by: Huimin She --- .../files/media-ttusb-dec-CVE-2014-8884.patch | 35 ++++++++++++++++++++++ recipes-kernel/linux/linux-qoriq-common.inc | 1 + 2 files changed, 36 insertions(+) create mode 100644 recipes-kernel/linux/files/media-ttusb-dec-CVE-2014-8884.patch diff --git a/recipes-kernel/linux/files/media-ttusb-dec-CVE-2014-8884.patch b/recipes-kernel/linux/files/media-ttusb-dec-CVE-2014-8884.patch new file mode 100644 index 0000000..08fe73b --- /dev/null +++ b/recipes-kernel/linux/files/media-ttusb-dec-CVE-2014-8884.patch @@ -0,0 +1,35 @@ +Date: Fri, 5 Sep 2014 09:09:28 -0300 +Subject: [media] ttusb-dec: buffer overflow in ioctl + +commit f2e323ec96077642d397bb1c355def536d489d16 upstream. + +We need to add a limit check here so we don't overflow the buffer. + +Fixes CVE-2014-8884 +Upstream-Status: Backport + +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Jiri Slaby +Signed-off-by: Sona Sarmadi +--- + drivers/media/usb/ttusb-dec/ttusbdecfe.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/usb/ttusb-dec/ttusbdecfe.c b/drivers/media/usb/ttusb-dec/ttusbdecfe.c +index 5c45c9d..9c29552 100644 +--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c ++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c +@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00 }; + ++ if (cmd->msg_len > sizeof(b) - 4) ++ return -EINVAL; ++ + memcpy(&b[4], cmd->msg, cmd->msg_len); + + state->config->send_command(fe, 0x72, +-- +cgit v0.11.2 + diff --git a/recipes-kernel/linux/linux-qoriq-common.inc b/recipes-kernel/linux/linux-qoriq-common.inc index dc7eab2..5a5d7e9 100644 --- a/recipes-kernel/linux/linux-qoriq-common.inc +++ b/recipes-kernel/linux/linux-qoriq-common.inc @@ -5,6 +5,7 @@ SRC_URI += "file://b4860-hard_irq_disable-bug.patch \ file://powerpc-fsl-booke64-Set-vmemmap_psize-to-4K.patch \ file://mm-CVE-2014-3122.patch \ file://IB-uverbs-CVE-2014-8159.patch \ + file://media-ttusb-dec-CVE-2014-8884.patch \ " SRC_URI += "file://cfg/00013-localversion.cfg \ -- cgit v1.2.3-54-g00ecf