Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2025-02-17 22:49:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

usb: gadget: rndis: Prevent InformationBufferOffset manipulation

Browse source 
Prevent access to arbitrary memory locations in gen_ndis_set_resp
via manipulation of buf->InformationBufferOffset. Original
implementation permits manipulation of InformationBufferOffset to
exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents
within a 32byte offset as the devices packet filter. The packet filter
value may be next retrieved using gen_ndis_query_resp so it is possible
to extract specific memory regions two bytes a time.

The rndis_query_response was not modified as neither the buffer offset
nor length passed to gen_ndis_query_resp is used.

Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
This commit is contained in:
Szymon Heidrich 2022-12-05 10:28:23 +01:00 • committed by Marek Vasut
parent bcd4110702
commit 51a0e215ec
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/usb/gadget/rndis.c
View file

@ -855,14 +855,17 @@ static int rndis_set_response(int configNr, rndis_set_msg_type *buf)
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
BufLength = get_unaligned_le32(&buf->InformationBufferLength);
BufOffset = get_unaligned_le32(&buf->InformationBufferOffset);
if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) ||
(BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset))
return -EINVAL;
r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *) r->buf;
BufLength = get_unaligned_le32(&buf->InformationBufferLength);
BufOffset = get_unaligned_le32(&buf->InformationBufferOffset);
#ifdef VERBOSE
debug("%s: Length: %d\n", __func__, BufLength);
debug("%s: Offset: %d\n", __func__, BufOffset);