Vulnerability: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
Vulnerability ID: CVE-2014-3185
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: drivers/usb/serial/whiteheat.c
Commit message: USB: whiteheat: Added bounds checking for bulk command response

This patch fixes a potential security issue in the whiteheat USB driver
which might allow a local attacker to cause kernel memory corrpution. This
is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
EHCI and XHCI busses it's possible to craft responses greater than 64
bytes leading a buffer overflow.

Signed-off-by: James Forshaw <forshaw@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: James Forshaw

Vulnerable version (before fix):
 static void command_port_read_callback(struct urb *urb) 		dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__); 		return; 	} 	if (status) { 		dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status); 		if (status != -ENOENT) static void command_port_read_callback(struct urb *urb) 		/* These are unsolicited reports from the firmware, hence no 		   waiting command to wakeup */ 		dev_dbg(&urb->dev->dev, "%s - event received\n", __func__); 	} else if (data[0] == WHITEHEAT_GET_DTR_RTS) { 		memcpy(command_info->result_buffer, &data[1], 						urb->actual_length - 1); 		command_info->command_finished = WHITEHEAT_CMD_COMPLETE;

Fixed version (after fix):
 static void command_port_read_callback(struct urb *urb) 		dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__); 		return; 	} 	if (!urb->actual_length) { 		dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__); 		return; 	} 	if (status) { 		dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status); 		if (status != -ENOENT) static void command_port_read_callback(struct urb *urb) 		/* These are unsolicited reports from the firmware, hence no 		   waiting command to wakeup */ 		dev_dbg(&urb->dev->dev, "%s - event received\n", __func__); 	} else if ((data[0] == WHITEHEAT_GET_DTR_RTS) && 		(urb->actual_length - 1 <= sizeof(command_info->result_buffer))) { 		memcpy(command_info->result_buffer, &data[1], 						urb->actual_length - 1); 		command_info->command_finished = WHITEHEAT_CMD_COMPLETE;

Patch:
patch: @@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
 		dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
 		return;
 	}
+	if (!urb->actual_length) {
+		dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
+		return;
+	}
 	if (status) {
 		dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
 		if (status != -ENOENT)
@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
 		/* These are unsolicited reports from the firmware, hence no
 		   waiting command to wakeup */
 		dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
-	} else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
+	} else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
+		(urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
 		memcpy(command_info->result_buffer, &data[1],
 						urb->actual_length - 1);
 		command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
path: drivers/usb/serial/whiteheat.c