Vulnerability: In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.
Vulnerability ID: CVE-2018-6412
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-01-31
File: drivers/video/fbdev/sbuslib.c
Commit message: fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().

Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
sbusfb_ioctl_helper().

'index' is defined as an int in sbusfb_ioctl_helper().
We retrieve this from the user:
if (get_user(index, &c->index) ||
    __get_user(count, &c->count) ||
    __get_user(ured, &c->red) ||
    __get_user(ugreen, &c->green) ||
    __get_user(ublue, &c->blue))
       return -EFAULT;

and then we use 'index' in the following way:
red = cmap->red[index + i] >> 8;
green = cmap->green[index + i] >> 8;
blue = cmap->blue[index + i] >> 8;

This is a classic information leak vulnerability. 'index' should be
an unsigned int, given its usage above.

This patch is straight-forward; it changes 'index' to unsigned int
in two switch-cases: FBIOGETCMAP_SPARC && FBIOPUTCMAP_SPARC.

This patch fixes CVE-2018-6412.

Signed-off-by: Peter Malone <peter.malone@gmail.com>
Acked-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Commit author: Peter Malone

Vulnerable version (before fix):
 int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 		unsigned char __user *ured; 		unsigned char __user *ugreen; 		unsigned char __user *ublue; 		int index, count, i;  		if (get_user(index, &c->index) || 		    __get_user(count, &c->count) || int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 		unsigned char __user *ugreen; 		unsigned char __user *ublue; 		struct fb_cmap *cmap = &info->cmap; 		int index, count, i; 		u8 red, green, blue;  		if (get_user(index, &c->index) ||

Fixed version (after fix):
 int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 		unsigned char __user *ured; 		unsigned char __user *ugreen; 		unsigned char __user *ublue; 		unsigned int index, count, i;  		if (get_user(index, &c->index) || 		    __get_user(count, &c->count) || int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 		unsigned char __user *ugreen; 		unsigned char __user *ublue; 		struct fb_cmap *cmap = &info->cmap; 		unsigned int index, count, i; 		u8 red, green, blue;  		if (get_user(index, &c->index) ||

Patch:
patch: @@ -122,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
 		unsigned char __user *ured;
 		unsigned char __user *ugreen;
 		unsigned char __user *ublue;
-		int index, count, i;
+		unsigned int index, count, i;
 
 		if (get_user(index, &c->index) ||
 		    __get_user(count, &c->count) ||
@@ -161,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
 		unsigned char __user *ugreen;
 		unsigned char __user *ublue;
 		struct fb_cmap *cmap = &info->cmap;
-		int index, count, i;
+		unsigned int index, count, i;
 		u8 red, green, blue;
 
 		if (get_user(index, &c->index) ||
path: drivers/video/fbdev/sbuslib.c