1 files changed, 51 insertions, 0 deletions

diff --git a/recipes-kernel/linux/files/0004-USB-CVE-2014-3185.patch b/recipes-kernel/linux/files/0004-USB-CVE-2014-3185.patch
new file mode 100644
index 0000000..0820807
--- /dev/null
+++ b/recipes-kernel/linux/files/0004-USB-CVE-2014-3185.patch
@@ -0,0 +1,51 @@
+From 6817ae225cd650fb1c3295d769298c38b1eba818 Mon Sep 17 00:00:00 2001
+From: James Forshaw <forshaw@google.com>
+Date: Sat, 23 Aug 2014 14:39:48 -0700
+Subject: [PATCH] USB: whiteheat: Added bounds checking for bulk command
+ response
+
+This patch fixes a potential security issue in the whiteheat USB driver
+which might allow a local attacker to cause kernel memory corrpution. This
+is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
+EHCI and XHCI busses it's possible to craft responses greater than 64
+bytes leading a buffer overflow.
+
+This fixes CVE-2014-3185
+Upstream-Status: Backport
+
+Signed-off-by: James Forshaw <forshaw@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/usb/serial/whiteheat.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index e62f2df..6c3734d 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
+                dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
+                return;
+        }
++       if (!urb->actual_length) {
++               dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
++               return;
++       }
+        if (status) {
+                dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
+                if (status != -ENOENT)
+@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
+                /* These are unsolicited reports from the firmware, hence no
+                   waiting command to wakeup */
+                dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
+-       } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
++       } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
++               (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
+                memcpy(command_info->result_buffer, &data[1],
+                                                urb->actual_length - 1);
+                command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
+-- 
+1.9.1
+