diff mbox

[10/14] HID: ntrig: validate feature report details

Message ID alpine.LNX.2.00.1308282221210.22181@pobox.suse.cz (mailing list archive)
State New, archived
Delegated to: Jiri Kosina
Headers show

Commit Message

Jiri Kosina Aug. 28, 2013, 8:31 p.m. UTC 
From: Kees Cook <keescook@chromium.org>

A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:

[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]

CVE-2013-2896

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
---
 drivers/hid/hid-ntrig.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Rafi Rubin Aug. 29, 2013, 3:12 p.m. UTC | #1 
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>

Thanks Kees,
Rafi

On 08/28/13 16:31, Jiri Kosina wrote:
> From: Kees Cook <keescook@chromium.org>
> 
> A HID device could send a malicious feature report that would cause the
> ntrig HID driver to trigger a NULL dereference during initialization:
> 
> [57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
> ...
> [57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
> [57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]
> 
> CVE-2013-2896
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Cc: stable@kernel.org
> ---
>  drivers/hid/hid-ntrig.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
> index ef95102..5482156 100644
> --- a/drivers/hid/hid-ntrig.c
> +++ b/drivers/hid/hid-ntrig.c
> @@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
>  	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
>  				    report_id_hash[0x0d];
>  
> -	if (!report)
> +	if (!report || report->maxfield < 1 ||
> +	    report->field[0]->report_count < 1)
>  		return -EINVAL;
>  
>  	hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Kosina Sept. 4, 2013, 10 a.m. UTC | #2 
On Thu, 29 Aug 2013, Rafi Rubin wrote:

> Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>

Applied.
diff mbox

Patch

diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index ef95102..5482156 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -115,7 +115,8 @@  static inline int ntrig_get_mode(struct hid_device *hdev)
 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
 				    report_id_hash[0x0d];
 
-	if (!report)
+	if (!report || report->maxfield < 1 ||
+	    report->field[0]->report_count < 1)
 		return -EINVAL;
 
 	hid_hw_request(hdev, report, HID_REQ_GET_REPORT);