rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.
Vulnerability ID: CVE-2017-15868
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-12-05
File: net/bluetooth/bnep/core.c
Commit message: Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket

same story as cmtp

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Commit author: Al Viro

Vulnerable version (before fix):
 int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)  	BT_DBG("");  	baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst); 	baswap((void *) src, &l2cap_pi(sock->sk)->chan->src); 

Fixed version (after fix):
 int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)  	BT_DBG("");  	if (!l2cap_is_socket(sock)) 		return -EBADFD;  	baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst); 	baswap((void *) src, &l2cap_pi(sock->sk)->chan->src); 

Patch:
patch: @@ -533,6 +533,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 
 	BT_DBG("");
 
+	if (!l2cap_is_socket(sock))
+		return -EBADFD;
+
 	baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);
 	baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);
path: net/bluetooth/bnep/core.c
Vulnerability: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.
Vulnerability ID: CVE-2017-15931
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-10-27
File: libr/bin/format/elf/elf.c
Commit message: Fix #8731 - Crash in ELF parser with negative 32bit number
Commit author: pancake

Vulnerable version (before fix):
 static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 			free (s); 		} 		sdb_num_set (sdb_version, "cnt", entry->vn_cnt, 0); 		vstart += entry->vn_aux; 		for (j = 0, isum = i + entry->vn_aux; j < entry->vn_cnt && vstart + sizeof (Elf_(Vernaux)) <= end; ++j) { 			int k; 			Elf_(Vernaux) * aux = NULL;

Fixed version (after fix):
 static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 			free (s); 		} 		sdb_num_set (sdb_version, "cnt", entry->vn_cnt, 0); 		st32 vnaux = entry->vn_aux; 		if (vnaux < 1) { 			goto beach; 		} 		vstart += vnaux; 		for (j = 0, isum = i + entry->vn_aux; j < entry->vn_cnt && vstart + sizeof (Elf_(Vernaux)) <= end; ++j) { 			int k; 			Elf_(Vernaux) * aux = NULL;

Patch:
patch: @@ -900,7 +900,11 @@ static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 			free (s);
 		}
 		sdb_num_set (sdb_version, "cnt", entry->vn_cnt, 0);
-		vstart += entry->vn_aux;
+		st32 vnaux = entry->vn_aux;
+		if (vnaux < 1) {
+			goto beach;
+		}
+		vstart += vnaux;
 		for (j = 0, isum = i + entry->vn_aux; j < entry->vn_cnt && vstart + sizeof (Elf_(Vernaux)) <= end; ++j) {
 			int k;
 			Elf_(Vernaux) * aux = NULL;
path: libr/bin/format/elf/elf.c
Vulnerability: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems.
Vulnerability ID: CVE-2017-15932
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-10-27
File: libr/bin/format/elf/elf.c
Commit message: Fix #8743 - Crash in ELF version parser on 32bit systems
Commit author: pancake

Vulnerable version (before fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 		verdef->vd_hash = READ32 (dfs, j) 		verdef->vd_aux = READ32 (dfs, j) 		verdef->vd_next = READ32 (dfs, j) 		vstart += verdef->vd_aux; 		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) { 			sdb_free (sdb_verdef); 			goto out_error;

Fixed version (after fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 		verdef->vd_hash = READ32 (dfs, j) 		verdef->vd_aux = READ32 (dfs, j) 		verdef->vd_next = READ32 (dfs, j) 		int vdaux = verdef->vd_aux; 		if (vdaux < 1) { 			sdb_free (sdb_verdef); 			goto out_error; 		} 		vstart += vdaux; 		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) { 			sdb_free (sdb_verdef); 			goto out_error;

Patch:
patch: @@ -748,7 +748,12 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		verdef->vd_hash = READ32 (dfs, j)
 		verdef->vd_aux = READ32 (dfs, j)
 		verdef->vd_next = READ32 (dfs, j)
-		vstart += verdef->vd_aux;
+		int vdaux = verdef->vd_aux;
+		if (vdaux < 1) {
+			sdb_free (sdb_verdef);
+			goto out_error;
+		}
+		vstart += vdaux;
 		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
 			sdb_free (sdb_verdef);
 			goto out_error;
path: libr/bin/format/elf/elf.c
Vulnerability: In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.
Vulnerability ID: CVE-2017-16357
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-11-01
File: libr/bin/format/elf/elf.c
Commit message: Fixed crash in elf.c with 32bit r2 when shdr->sh_size > max size_t
Commit author: Khairul Kasmiran

Vulnerable version (before fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 		return false; 	} 	link_shdr = &bin->shdr[shdr->sh_link]; 	if (shdr->sh_size < 1) { 		return false; 	} 	Elf_(Verdef) *defs = calloc (shdr->sh_size, sizeof (char)); static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 	if (shdr->sh_link > bin->ehdr.e_shnum) { 		return NULL; 	} 	if (shdr->sh_size < 1) { 		return NULL; 	} 	sdb = sdb_new0 ();

Fixed version (after fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 		return false; 	} 	link_shdr = &bin->shdr[shdr->sh_link]; 	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) { 		return false; 	} 	Elf_(Verdef) *defs = calloc (shdr->sh_size, sizeof (char)); static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 	if (shdr->sh_link > bin->ehdr.e_shnum) { 		return NULL; 	} 	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) { 		return NULL; 	} 	sdb = sdb_new0 ();

Patch:
patch: @@ -705,7 +705,7 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		return false;
 	}
 	link_shdr = &bin->shdr[shdr->sh_link];
-	if (shdr->sh_size < 1) {
+	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
 		return false;
 	}
 	Elf_(Verdef) *defs = calloc (shdr->sh_size, sizeof (char));
@@ -837,7 +837,7 @@ static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	if (shdr->sh_link > bin->ehdr.e_shnum) {
 		return NULL;
 	}
-	if (shdr->sh_size < 1) {
+	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
 		return NULL;
 	}
 	sdb = sdb_new0 ();
path: libr/bin/format/elf/elf.c
Vulnerability: In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.
Vulnerability ID: CVE-2017-16358
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-11-01
File: libr/bin/bin.c
Commit message: Fix #8748 - Fix oobread on string search
Commit author: pancake

Vulnerable version (before fix):
 static int string_scan_range(RList *list, const ut8 *buf, int min, 				// TODO: move into adjust_offset 				switch (str_type) { 				case R_STRING_TYPE_WIDE: 					{ 						const ut8 *p = buf  + str_start - 2; 						if (p[0] == 0xff && p[1] == 0xfe) { 							str_start -= 2; // \xff\xfe 						} 					} 					break; 				case R_STRING_TYPE_WIDE32: 					{ 						const ut8 *p = buf  + str_start - 4; 						if (p[0] == 0xff && p[1] == 0xfe) { 							str_start -= 4; // \xff\xfe\x00\x00 						}

Fixed version (after fix):
 static int string_scan_range(RList *list, const ut8 *buf, int min, 				// TODO: move into adjust_offset 				switch (str_type) { 				case R_STRING_TYPE_WIDE: 					if (str_start > 1) { 						const ut8 *p = buf + str_start - 2; 						if (p[0] == 0xff && p[1] == 0xfe) { 							str_start -= 2; // \xff\xfe 						} 					} 					break; 				case R_STRING_TYPE_WIDE32: 					if (str_start > 3) { 						const ut8 *p = buf + str_start - 4; 						if (p[0] == 0xff && p[1] == 0xfe) { 							str_start -= 4; // \xff\xfe\x00\x00 						}

Patch:
patch: @@ -352,16 +352,16 @@ static int string_scan_range(RList *list, const ut8 *buf, int min,
 				// TODO: move into adjust_offset
 				switch (str_type) {
 				case R_STRING_TYPE_WIDE:
-					{
-						const ut8 *p = buf  + str_start - 2;
+					if (str_start > 1) {
+						const ut8 *p = buf + str_start - 2;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 2; // \xff\xfe
 						}
 					}
 					break;
 				case R_STRING_TYPE_WIDE32:
-					{
-						const ut8 *p = buf  + str_start - 4;
+					if (str_start > 3) {
+						const ut8 *p = buf + str_start - 4;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 4; // \xff\xfe\x00\x00
 						}
path: libr/bin/bin.c
Vulnerability: drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16526
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-04
File: drivers/uwb/uwbd.c
Commit message: uwb: properly check kthread_run return value

uwbd_start() calls kthread_run() and checks that the return value is
not NULL. But the return value is not NULL in case kthread_run() fails,
it takes the form of ERR_PTR(-EINTR).

Use IS_ERR() instead.

Also add a check to uwbd_stop().

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Andrey Konovalov

Vulnerable version (before fix):
 static int uwbd(void *param) /** Start the UWB daemon */ void uwbd_start(struct uwb_rc *rc) { 	rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); 	if (rc->uwbd.task == NULL) 		printk(KERN_ERR "UWB: Cannot start management daemon; " 		       "UWB won't work\n"); 	else 		rc->uwbd.pid = rc->uwbd.task->pid; }  /* Stop the UWB daemon and free any unprocessed events */ void uwbd_stop(struct uwb_rc *rc) { 	kthread_stop(rc->uwbd.task); 	uwbd_flush(rc); } 

Fixed version (after fix):
 static int uwbd(void *param) /** Start the UWB daemon */ void uwbd_start(struct uwb_rc *rc) { 	struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); 	if (IS_ERR(task)) { 		rc->uwbd.task = NULL; 		printk(KERN_ERR "UWB: Cannot start management daemon; " 		       "UWB won't work\n"); 	} else { 		rc->uwbd.task = task; 		rc->uwbd.pid = rc->uwbd.task->pid; 	} }  /* Stop the UWB daemon and free any unprocessed events */ void uwbd_stop(struct uwb_rc *rc) { 	if (rc->uwbd.task) 		kthread_stop(rc->uwbd.task); 	uwbd_flush(rc); } 

Patch:
patch: @@ -302,18 +302,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-	rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
-	if (rc->uwbd.task == NULL)
+	struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+	if (IS_ERR(task)) {
+		rc->uwbd.task = NULL;
 		printk(KERN_ERR "UWB: Cannot start management daemon; "
 		       "UWB won't work\n");
-	else
+	} else {
+		rc->uwbd.task = task;
 		rc->uwbd.pid = rc->uwbd.task->pid;
+	}
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-	kthread_stop(rc->uwbd.task);
+	if (rc->uwbd.task)
+		kthread_stop(rc->uwbd.task);
 	uwbd_flush(rc);
 }
path: drivers/uwb/uwbd.c
Vulnerability: The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16532
CWE: CWE-476
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-04
File: drivers/usb/misc/usbtest.c
Commit message: usb: usbtest: fix NULL pointer dereference

If the usbtest driver encounters a device with an IN bulk endpoint but
no OUT bulk endpoint, it will try to dereference a NULL pointer
(out->desc.bEndpointAddress).  The problem can be solved by adding a
missing test.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Commit author: Alan Stern

Vulnerable version (before fix):
 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) 			return tmp; 	}  	if (in) { 		dev->in_pipe = usb_rcvbulkpipe(udev, 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 		dev->out_pipe = usb_sndbulkpipe(udev, 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 	} 	if (iso_in) { 		dev->iso_in = &iso_in->desc; 		dev->in_iso_pipe = usb_rcvisocpipe(udev,

Fixed version (after fix):
 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) 			return tmp; 	}  	if (in) 		dev->in_pipe = usb_rcvbulkpipe(udev, 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 	if (out) 		dev->out_pipe = usb_sndbulkpipe(udev, 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);  	if (iso_in) { 		dev->iso_in = &iso_in->desc; 		dev->in_iso_pipe = usb_rcvisocpipe(udev,

Patch:
patch: @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 			return tmp;
 	}
 
-	if (in) {
+	if (in)
 		dev->in_pipe = usb_rcvbulkpipe(udev,
 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+	if (out)
 		dev->out_pipe = usb_sndbulkpipe(udev,
 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-	}
+
 	if (iso_in) {
 		dev->iso_in = &iso_in->desc;
 		dev->in_iso_pipe = usb_rcvisocpipe(udev,
path: drivers/usb/misc/usbtest.c
Vulnerability: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16534
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-04
File: drivers/usb/core/message.c
Commit message: USB: core: harden cdc_parse_cdc_header

Andrey Konovalov reported a possible out-of-bounds problem for the
cdc_parse_cdc_header function.  He writes:
	It looks like cdc_parse_cdc_header() doesn't validate buflen
	before accessing buffer[1], buffer[2] and so on. The only check
	present is while (buflen > 0).

So fix this issue up by properly validating the buffer length matches
what the descriptor says it is.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Greg Kroah-Hartman

Vulnerable version (before fix):
 int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, 			elength = 1; 			goto next_desc; 		} 		if (buffer[1] != USB_DT_CS_INTERFACE) { 			dev_err(&intf->dev, "skipping garbage\n"); 			goto next_desc;

Fixed version (after fix):
 int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, 			elength = 1; 			goto next_desc; 		} 		if ((buflen < elength) || (elength < 3)) { 			dev_err(&intf->dev, "invalid descriptor buffer length\n"); 			break; 		} 		if (buffer[1] != USB_DT_CS_INTERFACE) { 			dev_err(&intf->dev, "skipping garbage\n"); 			goto next_desc;

Patch:
patch: @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
 			elength = 1;
 			goto next_desc;
 		}
+		if ((buflen < elength) || (elength < 3)) {
+			dev_err(&intf->dev, "invalid descriptor buffer length\n");
+			break;
+		}
 		if (buffer[1] != USB_DT_CS_INTERFACE) {
 			dev_err(&intf->dev, "skipping garbage\n");
 			goto next_desc;
path: drivers/usb/core/message.c
Vulnerability: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16535
CWE: CWE-125
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-04
File: drivers/usb/core/config.c
Commit message: USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()

Andrey used the syzkaller fuzzer to find an out-of-bounds memory
access in usb_get_bos_descriptor().  The code wasn't checking that the
next usb_dev_cap_header structure could fit into the remaining buffer
space.

This patch fixes the error and also reduces the bNumDeviceCaps field
in the header to match the actual number of capabilities found, in
cases where there are fewer than expected.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Alan Stern

Vulnerable version (before fix):
 int usb_get_bos_descriptor(struct usb_device *dev) 	for (i = 0; i < num; i++) { 		buffer += length; 		cap = (struct usb_dev_cap_header *)buffer; 		length = cap->bLength;  		if (total_len < length) 			break; 		total_len -= length;  		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {

Fixed version (after fix):
 int usb_get_bos_descriptor(struct usb_device *dev) 	for (i = 0; i < num; i++) { 		buffer += length; 		cap = (struct usb_dev_cap_header *)buffer;  		if (total_len < sizeof(*cap) || total_len < cap->bLength) { 			dev->bos->desc->bNumDeviceCaps = i; 			break; 		} 		length = cap->bLength; 		total_len -= length;  		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {

Patch:
patch: @@ -960,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 	for (i = 0; i < num; i++) {
 		buffer += length;
 		cap = (struct usb_dev_cap_header *)buffer;
-		length = cap->bLength;
 
-		if (total_len < length)
+		if (total_len < sizeof(*cap) || total_len < cap->bLength) {
+			dev->bos->desc->bNumDeviceCaps = i;
 			break;
+		}
+		length = cap->bLength;
 		total_len -= length;
 
 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
path: drivers/usb/core/config.c
Vulnerability: The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
Vulnerability ID: CVE-2017-16539
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/moby/moby
Published: 2017-11-04
File: oci/defaults.go
Commit message: Add /proc/scsi to masked paths

This is writeable, and can be used to remove devices. Containers do
not need to know about scsi devices.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Commit author: Justin Cormack

Vulnerable version (before fix):
 func DefaultLinuxSpec() specs.Spec { 			"/proc/timer_list", 			"/proc/timer_stats", 			"/proc/sched_debug", 		}, 		ReadonlyPaths: []string{ 			"/proc/asound",

Fixed version (after fix):
 func DefaultLinuxSpec() specs.Spec { 			"/proc/timer_list", 			"/proc/timer_stats", 			"/proc/sched_debug", 			"/proc/scsi", 		}, 		ReadonlyPaths: []string{ 			"/proc/asound",

Patch:
patch: @@ -119,6 +119,7 @@ func DefaultLinuxSpec() specs.Spec {
 			"/proc/timer_list",
 			"/proc/timer_stats",
 			"/proc/sched_debug",
+			"/proc/scsi",
 		},
 		ReadonlyPaths: []string{
 			"/proc/asound",
path: oci/defaults.go
Vulnerability: The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16643
CWE: CWE-125
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-07
File: drivers/input/tablet/gtco.c
Commit message: Input: gtco - fix potential out-of-bound access

parse_hid_report_descriptor() has a while (i < length) loop, which
only guarantees that there's at least 1 byte in the buffer, but the
loop body can read multiple bytes which causes out-of-bounds access.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit author: Dmitry Torokhov

Vulnerable version (before fix):
 static void parse_hid_report_descriptor(struct gtco *device, char * report,  	/* Walk  this report and pull out the info we need */ 	while (i < length) { 		prefix = report[i];  		/* Skip over prefix */ 		i++;  		/* Determine data size and save the data in the proper variable */ 		size = PREF_SIZE(prefix); 		switch (size) { 		case 1: 			data = report[i]; 			break; 		case 2: 			data16 = get_unaligned_le16(&report[i]); 			break; 		case 3: 			size = 4; 			data32 = get_unaligned_le32(&report[i]); 			break; 		}

Fixed version (after fix):
 static void parse_hid_report_descriptor(struct gtco *device, char * report,  	/* Walk  this report and pull out the info we need */ 	while (i < length) { 		prefix = report[i++];  		/* Determine data size and save the data in the proper variable */ 		size = (1U << PREF_SIZE(prefix)) >> 1; 		if (i + size > length) { 			dev_err(ddev, 				"Not enough data (need %d, have %d)\n", 				i + size, length); 			break; 		}  		switch (size) { 		case 1: 			data = report[i]; 			break; 		case 2: 			data16 = get_unaligned_le16(&report[i]); 			break; 		case 4: 			data32 = get_unaligned_le32(&report[i]); 			break; 		}

Patch:
patch: @@ -230,22 +230,25 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 
 	/* Walk  this report and pull out the info we need */
 	while (i < length) {
-		prefix = report[i];
-
-		/* Skip over prefix */
-		i++;
+		prefix = report[i++];
 
 		/* Determine data size and save the data in the proper variable */
-		size = PREF_SIZE(prefix);
+		size = (1U << PREF_SIZE(prefix)) >> 1;
+		if (i + size > length) {
+			dev_err(ddev,
+				"Not enough data (need %d, have %d)\n",
+				i + size, length);
+			break;
+		}
+
 		switch (size) {
 		case 1:
 			data = report[i];
 			break;
 		case 2:
 			data16 = get_unaligned_le16(&report[i]);
 			break;
-		case 3:
-			size = 4;
+		case 4:
 			data32 = get_unaligned_le32(&report[i]);
 			break;
 		}
path: drivers/input/tablet/gtco.c