Attachment 25371 Details for Bug 62595

usb-leak.txt

usb-leak.txt (text/plain), 2.67 KB, created by Thomas Biege on 2004-10-25 21:39:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-10-25 21:39:09 UTC

Size: 2.67 KB

patch

obsolete

>From acme@conectiva.com.br Fri Oct 24 09:11:42 2003
>Date: Thu, 23 Oct 2003 12:21:52 -0300
>From: Arnaldo Carvalho de Melo <acme@conectiva.com.br>
>To: Greg Kroah-Hartman <greg@kroah.com>
>Cc: Linus Torvalds <torvalds@osdl.org>, security@conectiva.com.br
>Subject: [vendor-sec] [PATCH] leaking info on drivers/usb
>Resent-Date: Thu, 23 Oct 2003 13:25:05 -0200
>Resent-From: andreas@conectiva.com.br
>Resent-To: vendor-sec@lst.de
>X-Keywords:                 
>X-UID: 2389
>
>Hi,
>
>	I'm doing an audit wrt copy_to_user leaking info to userspace, started
>with drivers/usb, please apply.
>
>	Linus, a sparse based tool to catch those things would be nice...
>
>- Arnaldo
>
>===== drivers/usb/class/audio.c 1.41 vs edited =====
>--- 1.41/drivers/usb/class/audio.c	Tue Aug 26 13:25:41 2003
>+++ edited/drivers/usb/class/audio.c	Thu Oct 23 12:59:04 2003
>@@ -2007,6 +2007,8 @@
>   
> 	if (cmd == SOUND_MIXER_INFO) {
> 		mixer_info info;
>+
>+		memset(&info, 0, sizeof(info));
> 		strncpy(info.id, "USB_AUDIO", sizeof(info.id));
> 		strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
> 		info.modify_counter = ms->modcnt;
>@@ -2016,6 +2018,8 @@
> 	}
> 	if (cmd == SOUND_OLD_MIXER_INFO) {
> 		_old_mixer_info info;
>+
>+		memset(&info, 0, sizeof(info));
> 		strncpy(info.id, "USB_AUDIO", sizeof(info.id));
> 		strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
> 		if (copy_to_user((void __user *)arg, &info, sizeof(info)))
>===== drivers/usb/media/vicam.c 1.40 vs edited =====
>--- 1.40/drivers/usb/media/vicam.c	Tue Sep 16 17:44:57 2003
>+++ edited/drivers/usb/media/vicam.c	Thu Oct 23 13:09:53 2003
>@@ -539,6 +539,7 @@
> 			struct video_capability b;
> 
> 			DBG("VIDIOCGCAP\n");
>+			memset(&b, 0, sizeof(b));
> 			strcpy(b.name, "ViCam-based Camera");
> 			b.type = VID_TYPE_CAPTURE;
> 			b.channels = 1;
>===== drivers/usb/misc/brlvger.c 1.23 vs edited =====
>--- 1.23/drivers/usb/misc/brlvger.c	Wed Oct  1 10:22:54 2003
>+++ edited/drivers/usb/misc/brlvger.c	Thu Oct 23 13:10:58 2003
>@@ -711,6 +711,7 @@
> 	case BRLVGER_GET_INFO: {
> 		struct brlvger_info vi;
> 
>+		memset(&vi, 0, sizeof(vi));
> 		strlcpy(vi.driver_version, DRIVER_VERSION,
> 			sizeof(vi.driver_version));
> 		strlcpy(vi.driver_banner, longbanner,
>===== drivers/usb/serial/io_edgeport.c 1.50 vs edited =====
>--- 1.50/drivers/usb/serial/io_edgeport.c	Sat Aug 23 16:56:50 2003
>+++ edited/drivers/usb/serial/io_edgeport.c	Thu Oct 23 13:13:25 2003
>@@ -1906,6 +1906,7 @@
> 
> 		case TIOCGICOUNT:
> 			cnow = edge_port->icount;
>+			memset(&icount, 0, sizeof(icount));
> 			icount.cts = cnow.cts;
> 			icount.dsr = cnow.dsr;
> 			icount.rng = cnow.rng;
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View

Attachments on bug 62595: 25371