Patch "[media] usbvision fix overflow of interfaces array" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

[media] usbvision fix overflow of interfaces array

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usbvision-fix-overflow-of-interfaces-array.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Oliver Neukum <[email protected]>
Date: Tue, 27 Oct 2015 09:51:34 -0200
Subject: [media] usbvision fix overflow of interfaces array

From: Oliver Neukum <[email protected]>

commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream.

This fixes the crash reported in:
http://seclists.org/bugtraq/2015/Oct/35
The interface number needs a sanity check.

---
 drivers/media/usb/usbvision/usbvision-video.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_in
 	printk(KERN_INFO "%s: %s found\n", __func__,
 				usbvision_device_data[model].model_string);
 
+	/*
+	 * this is a security check.
+	 * an exploit using an incorrect bInterfaceNumber is known
+	 */
+	if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
+		return -ENODEV;
+
 	if (usbvision_device_data[model].interface >= 0)
 		interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
 	else if (ifnum < dev->actconfig->desc.bNumInterfaces)

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch

please, do not add 588afcc1. reasons: see upstream commit:

commit d5468d7afaa9c9e961e150f0455a14a9f4872a98
[media] usbvision: revert commit 588afcc1

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: [email protected]
To: [email protected], [email protected], "hans verkuil" <[email protected]>, [email protected], [email protected], [email protected]
Cc: [email protected], [email protected]
Sent: Saturday, June 4, 2016 9:43:20 PM
Subject: Patch "[media] usbvision fix overflow of interfaces array" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

[media] usbvision fix overflow of interfaces array

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usbvision-fix-overflow-of-interfaces-array.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Oliver Neukum <[email protected]>
Date: Tue, 27 Oct 2015 09:51:34 -0200
Subject: [media] usbvision fix overflow of interfaces array

From: Oliver Neukum <[email protected]>

commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream.

This fixes the crash reported in:
http://seclists.org/bugtraq/2015/Oct/35
The interface number needs a sanity check.

---
 drivers/media/usb/usbvision/usbvision-video.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_in
 	printk(KERN_INFO "%s: %s found\n", __func__,
 				usbvision_device_data[model].model_string);
 
+	/*
+	 * this is a security check.
+	 * an exploit using an incorrect bInterfaceNumber is known
+	 */
+	if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
+		return -ENODEV;
+
 	if (usbvision_device_data[model].interface >= 0)
 		interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
 	else if (ifnum < dev->actconfig->desc.bNumInterfaces)

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch

Thanks for the info, I knew there was some reason I had dropped this before.

Moritz, please tell Debian to also drop it so that I don't make this mistake for the 3rd time sometime in the future...

thanks,

greg k-h

Sorry for the confusion! I've updated the Debian kernel security tracker to drop the wrong commit reference.

The kernel in Debian unstable is using 4.6.1 now, so it no longer carries backported patches for this bug.

Cheers,
Moritz