Re: Security issue in linux/drivers/firewire/nosy.c
Brought to you by:
aeb,
bencollins
From: Takashi S. <o-t...@sa...> - 2024-04-02 14:33:09
|
Hi Thanassis, Thanks for your contacting to me about the issue. On Tue, Apr 2, 2024, at 22:56, Thanassis Avgerinos wrote: > Dear Sakamoto-san, > > I apologize for the email - I am sure you are very busy. Thank you for > all the work to help maintain firewire in the Linux trunk. > > I will be brief to not waste your time. I am contacting you to report a > possible security issue in firewire/nosy.c:L151 which reads: > > ``` > /* FIXME: Check length <= user_length. */ > > end = buffer->data + buffer->capacity; > length = buffer->head->length; > > if (&buffer->head->data[length] < end) { > if (copy_to_user(data, buffer->head->data, length)) > return -EFAULT; > ``` > > Note that the user-supplied length is not respected at all when reading > bytes from the wire which can lead to a number of issues (including > security ones such as overflows). > > I believe this is potentially serious but also quite fixable. Would you > accept a patch? Should I contact the security team instead? > > Thank you for your time. I'm pleased to review your fix for the issue;) I don't mind that you post it just to me, since any mailing list demands you to subscribe it in advance when posting, and it is a bit cumbersome just to send patches. Additionally, I don't mind the patch format as long as it includes enough fractions to fix the issue. In the case, I'll revise it for the complete patches, alternatively. Thanks Takashi Sakamoto |