mirror of
https://github.com/AsahiLinux/u-boot
synced 2024-11-17 02:08:38 +00:00
51a0e215ec
Prevent access to arbitrary memory locations in gen_ndis_set_resp via manipulation of buf->InformationBufferOffset. Original implementation permits manipulation of InformationBufferOffset to exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents within a 32byte offset as the devices packet filter. The packet filter value may be next retrieved using gen_ndis_query_resp so it is possible to extract specific memory regions two bytes a time. The rndis_query_response was not modified as neither the buffer offset nor length passed to gen_ndis_query_resp is used. Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> |
||
|---|---|---|
| .. | ||
| cdns3 | ||
| common | ||
| dwc3 | ||
| emul | ||
| eth | ||
| gadget | ||
| host | ||
| isp1760 | ||
| mtu3 | ||
| musb | ||
| musb-new | ||
| phy | ||
| ulpi | ||
| Kconfig | ||