diff options
| author | Szymon Heidrich <szymon.heidrich@gmail.com> | 2022-12-05 10:28:23 +0100 |
|---|---|---|
| committer | Marek Vasut <marex@denx.de> | 2022-12-08 14:30:39 +0100 |
| commit | 51a0e215ec8ce9cc88f928373e9ce8303db1829b (patch) | |
| tree | 3a9a0c24dd774508eb9a05d0c67a1d5f606f9e97 | |
| parent | bcd4110702d38c5356c84da6dc286c565ec19db3 (diff) | |
| download | u-boot-51a0e215ec8ce9cc88f928373e9ce8303db1829b.zip u-boot-51a0e215ec8ce9cc88f928373e9ce8303db1829b.tar.gz u-boot-51a0e215ec8ce9cc88f928373e9ce8303db1829b.tar.bz2 | |
usb: gadget: rndis: Prevent InformationBufferOffset manipulation
Prevent access to arbitrary memory locations in gen_ndis_set_resp
via manipulation of buf->InformationBufferOffset. Original
implementation permits manipulation of InformationBufferOffset to
exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents
within a 32byte offset as the devices packet filter. The packet filter
value may be next retrieved using gen_ndis_query_resp so it is possible
to extract specific memory regions two bytes a time.
The rndis_query_response was not modified as neither the buffer offset
nor length passed to gen_ndis_query_resp is used.
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
| -rw-r--r-- | drivers/usb/gadget/rndis.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index 13c327e..3948f2c 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -855,14 +855,17 @@ static int rndis_set_response(int configNr, rndis_set_msg_type *buf) rndis_set_cmplt_type *resp; rndis_resp_t *r; + BufLength = get_unaligned_le32(&buf->InformationBufferLength); + BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); + if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) || + (BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset)) + return -EINVAL; + r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type)); if (!r) return -ENOMEM; resp = (rndis_set_cmplt_type *) r->buf; - BufLength = get_unaligned_le32(&buf->InformationBufferLength); - BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); - #ifdef VERBOSE debug("%s: Length: %d\n", __func__, BufLength); debug("%s: Offset: %d\n", __func__, BufOffset); |