Searched hist:f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/drivers/usb/misc/ |
| H A D | yurex.c | diff f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 Fri Jul 06 10:12:56 CDT 2018 Jann Horn <jannh@google.com> USB: yurex: fix out-of-bounds uaccess in read handler
In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.
Fix it by using simple_read_from_buffer() instead of custom logic.
Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|