From b743c20e004d23a8eb0f5f7553a0c709284336c0 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Thu, 21 Jan 2016 11:10:26 +0100 Subject: usb-whiteheat: CVE-2015-5257 Fixes NULL pointer dereference in USB WhiteHEAT serial. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5257 Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/ patch/?id=fe6689e03318d5745d88328395fd326e08238533 Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- .../linux/files/usb-whiteheat-CVE-2015-5257.patch | 85 ++++++++++++++++++++++ recipes-kernel/linux/linux-qoriq-common.inc | 1 + recipes-kernel/linux/linux-yocto_3.14.bbappend | 1 + 3 files changed, 87 insertions(+) create mode 100644 recipes-kernel/linux/files/usb-whiteheat-CVE-2015-5257.patch diff --git a/recipes-kernel/linux/files/usb-whiteheat-CVE-2015-5257.patch b/recipes-kernel/linux/files/usb-whiteheat-CVE-2015-5257.patch new file mode 100644 index 0000000..e1fd45f --- /dev/null +++ b/recipes-kernel/linux/files/usb-whiteheat-CVE-2015-5257.patch @@ -0,0 +1,85 @@ +From fe6689e03318d5745d88328395fd326e08238533 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 23 Sep 2015 11:41:42 -0700 +Subject: USB: whiteheat: fix potential null-deref at probe + +commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream. + +Fix potential null-pointer dereference at probe by making sure that the +required endpoints are present. + +The whiteheat driver assumes there are at least five pairs of bulk +endpoints, of which the final pair is used for the "command port". An +attempt to bind to an interface with fewer bulk endpoints would +currently lead to an oops. + +Fixes CVE-2015-5257. +Upstream-Status: Backport + +Reported-by: Moein Ghasemzadeh +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c +index 6c3734d..d3ea90b 100644 +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial, + static int whiteheat_firmware_attach(struct usb_serial *serial); + + /* function prototypes for the Connect Tech WhiteHEAT serial converter */ ++static int whiteheat_probe(struct usb_serial *serial, ++ const struct usb_device_id *id); + static int whiteheat_attach(struct usb_serial *serial); + static void whiteheat_release(struct usb_serial *serial); + static int whiteheat_port_probe(struct usb_serial_port *port); +@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = { + .description = "Connect Tech - WhiteHEAT", + .id_table = id_table_std, + .num_ports = 4, ++ .probe = whiteheat_probe, + .attach = whiteheat_attach, + .release = whiteheat_release, + .port_probe = whiteheat_port_probe, +@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial) + /***************************************************************************** + * Connect Tech's White Heat serial driver functions + *****************************************************************************/ ++ ++static int whiteheat_probe(struct usb_serial *serial, ++ const struct usb_device_id *id) ++{ ++ struct usb_host_interface *iface_desc; ++ struct usb_endpoint_descriptor *endpoint; ++ size_t num_bulk_in = 0; ++ size_t num_bulk_out = 0; ++ size_t min_num_bulk; ++ unsigned int i; ++ ++ iface_desc = serial->interface->cur_altsetting; ++ ++ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) { ++ endpoint = &iface_desc->endpoint[i].desc; ++ if (usb_endpoint_is_bulk_in(endpoint)) ++ ++num_bulk_in; ++ if (usb_endpoint_is_bulk_out(endpoint)) ++ ++num_bulk_out; ++ } ++ ++ min_num_bulk = COMMAND_PORT + 1; ++ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk) ++ return -ENODEV; ++ ++ return 0; ++} ++ + static int whiteheat_attach(struct usb_serial *serial) + { + struct usb_serial_port *command_port; +-- +cgit v0.12 + diff --git a/recipes-kernel/linux/linux-qoriq-common.inc b/recipes-kernel/linux/linux-qoriq-common.inc index 62038e5..a0dfa69 100644 --- a/recipes-kernel/linux/linux-qoriq-common.inc +++ b/recipes-kernel/linux/linux-qoriq-common.inc @@ -13,6 +13,7 @@ SRC_URI += "file://b4860-hard_irq_disable-bug.patch \ file://eCryptfs-CVE-2014-9683.patch \ file://netfilter-CVE-2014-9715.patch \ file://net-sctp-CVE-2015-1421.patch \ + file://usb-whiteheat-CVE-2015-5257.patch \ " SRC_URI += "file://cfg/00013-localversion.cfg \ diff --git a/recipes-kernel/linux/linux-yocto_3.14.bbappend b/recipes-kernel/linux/linux-yocto_3.14.bbappend index 10ea463..4b9e525 100644 --- a/recipes-kernel/linux/linux-yocto_3.14.bbappend +++ b/recipes-kernel/linux/linux-yocto_3.14.bbappend @@ -19,4 +19,5 @@ SRC_URI += "file://HID_CVE_patches/0005-HID-steelseries-validate-output-report-d file://ipv6-CVE-2015-2922.patch \ file://ipv4-CVE-2015-3636.patch \ file://udf-CVE-2015-4167.patch \ + file://usb-whiteheat-CVE-2015-5257.patch \ " -- cgit v1.2.3-54-g00ecf