0048-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116
  1. From 128c16a682034263eb519c89bc0934eeb6fa8cfa Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Fri, 11 Dec 2020 19:19:21 +0100
  4. Subject: [PATCH] usb: Avoid possible out-of-bound accesses caused by malicious
  5. devices
  6. The maximum number of configurations and interfaces are fixed but there is
  7. no out-of-bound checking to prevent a malicious USB device to report large
  8. values for these and cause accesses outside the arrays' memory.
  9. Fixes: CVE-2020-25647
  10. Reported-by: Joseph Tartaro <joseph.tartaro@ioactive.com>
  11. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
  12. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  13. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  14. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  15. ---
  16. grub-core/bus/usb/usb.c | 15 ++++++++++++---
  17. include/grub/usb.h | 10 +++++++---
  18. 2 files changed, 19 insertions(+), 6 deletions(-)
  19. diff --git a/grub-core/bus/usb/usb.c b/grub-core/bus/usb/usb.c
  20. index 8da5e4c..7cb3cc2 100644
  21. --- a/grub-core/bus/usb/usb.c
  22. +++ b/grub-core/bus/usb/usb.c
  23. @@ -75,6 +75,9 @@ grub_usb_controller_iterate (grub_usb_controller_iterate_hook_t hook,
  24. grub_usb_err_t
  25. grub_usb_clear_halt (grub_usb_device_t dev, int endpoint)
  26. {
  27. + if (endpoint >= GRUB_USB_MAX_TOGGLE)
  28. + return GRUB_USB_ERR_BADDEVICE;
  29. +
  30. dev->toggle[endpoint] = 0;
  31. return grub_usb_control_msg (dev, (GRUB_USB_REQTYPE_OUT
  32. | GRUB_USB_REQTYPE_STANDARD
  33. @@ -134,10 +137,10 @@ grub_usb_device_initialize (grub_usb_device_t dev)
  34. return err;
  35. descdev = &dev->descdev;
  36. - for (i = 0; i < 8; i++)
  37. + for (i = 0; i < GRUB_USB_MAX_CONF; i++)
  38. dev->config[i].descconf = NULL;
  39. - if (descdev->configcnt == 0)
  40. + if (descdev->configcnt == 0 || descdev->configcnt > GRUB_USB_MAX_CONF)
  41. {
  42. err = GRUB_USB_ERR_BADDEVICE;
  43. goto fail;
  44. @@ -172,6 +175,12 @@ grub_usb_device_initialize (grub_usb_device_t dev)
  45. /* Skip the configuration descriptor. */
  46. pos = dev->config[i].descconf->length;
  47. + if (dev->config[i].descconf->numif > GRUB_USB_MAX_IF)
  48. + {
  49. + err = GRUB_USB_ERR_BADDEVICE;
  50. + goto fail;
  51. + }
  52. +
  53. /* Read all interfaces. */
  54. for (currif = 0; currif < dev->config[i].descconf->numif; currif++)
  55. {
  56. @@ -217,7 +226,7 @@ grub_usb_device_initialize (grub_usb_device_t dev)
  57. fail:
  58. - for (i = 0; i < 8; i++)
  59. + for (i = 0; i < GRUB_USB_MAX_CONF; i++)
  60. grub_free (dev->config[i].descconf);
  61. return err;
  62. diff --git a/include/grub/usb.h b/include/grub/usb.h
  63. index 512ae1d..6475c55 100644
  64. --- a/include/grub/usb.h
  65. +++ b/include/grub/usb.h
  66. @@ -23,6 +23,10 @@
  67. #include <grub/usbdesc.h>
  68. #include <grub/usbtrans.h>
  69. +#define GRUB_USB_MAX_CONF 8
  70. +#define GRUB_USB_MAX_IF 32
  71. +#define GRUB_USB_MAX_TOGGLE 256
  72. +
  73. typedef struct grub_usb_device *grub_usb_device_t;
  74. typedef struct grub_usb_controller *grub_usb_controller_t;
  75. typedef struct grub_usb_controller_dev *grub_usb_controller_dev_t;
  76. @@ -167,7 +171,7 @@ struct grub_usb_configuration
  77. struct grub_usb_desc_config *descconf;
  78. /* Interfaces associated to this configuration. */
  79. - struct grub_usb_interface interf[32];
  80. + struct grub_usb_interface interf[GRUB_USB_MAX_IF];
  81. };
  82. struct grub_usb_hub_port
  83. @@ -191,7 +195,7 @@ struct grub_usb_device
  84. struct grub_usb_controller controller;
  85. /* Device configurations (after opening the device). */
  86. - struct grub_usb_configuration config[8];
  87. + struct grub_usb_configuration config[GRUB_USB_MAX_CONF];
  88. /* Device address. */
  89. int addr;
  90. @@ -203,7 +207,7 @@ struct grub_usb_device
  91. int initialized;
  92. /* Data toggle values (used for bulk transfers only). */
  93. - int toggle[256];
  94. + int toggle[GRUB_USB_MAX_TOGGLE];
  95. /* Used by libusb wrapper. Schedulded for removal. */
  96. void *data;
  97. --
  98. 2.14.2