diff options
| author | James Forshaw <[email protected]> | 2014-08-23 21:39:48 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2014-08-24 19:15:08 +0000 |
| commit | 6817ae225cd650fb1c3295d769298c38b1eba818 (patch) | |
| tree | d69bd853fbfce025a5f5b52af6085f61ae8e8808 /tools/usb/usbip/libsrc/sysfs_utils.c | |
| parent | Merge tag 'usb-serial-3.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/... (diff) | |
| download | kernel-6817ae225cd650fb1c3295d769298c38b1eba818.tar.gz kernel-6817ae225cd650fb1c3295d769298c38b1eba818.zip | |
USB: whiteheat: Added bounds checking for bulk command response
This patch fixes a potential security issue in the whiteheat USB driver
which might allow a local attacker to cause kernel memory corrpution. This
is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
EHCI and XHCI busses it's possible to craft responses greater than 64
bytes leading a buffer overflow.
Signed-off-by: James Forshaw <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'tools/usb/usbip/libsrc/sysfs_utils.c')
0 files changed, 0 insertions, 0 deletions