In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: FCP: do not copy out an uninitialised init response<\/p>\n
fcp_ioctl_init() allocates its response buffer with kmalloc() and copies
\nthe whole buffer back to userspace:<\/p>\n
\tbuf_size = init.step0_resp_size + init.step2_resp_size;<\/p>\n
\tvoid *resp __free(kfree) =
\n\t\tkmalloc(buf_size, GFP_KERNEL);
\n\t…
\n\tif (copy_to_user(arg->resp, resp, buf_size))
\n\t\treturn -EFAULT;<\/p>\n
Nothing clears the buffer, and the only writer of its leading
\nstep0_resp_size bytes is the step-0 control transfer:<\/p>\n
\terr = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
\n\t\tFCP_USB_REQ_STEP0,
\n\t\tUSB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
\n\t\t0, private->bInterfaceNumber,
\n\t\tstep0_resp, private->step0_resp_size);
\n\tif (err < 0)
\n\t\treturn err;<\/p>\n
usb_fill_control_urb() does not set URB_SHORT_NOT_OK, so a short or
\nzero-length data stage completes with status 0 and snd_usb_ctl_msg()
\nreturns a small actual_length. The only check is err < 0, so a short
\ntransfer is accepted as success.<\/p>\n
snd_usb_ctl_msg() copies the full size back unconditionally:<\/p>\n
\tbuf = kmemdup(data, size, GFP_KERNEL);
\n\t…
\n\tmemcpy(data, buf, size);<\/p>\n
Bytes the device never wrote are therefore restored into resp unchanged
\nand copied to userspace. step0_resp_size and step2_resp_size are each
\nvalidated only to 1..255, so the caller also picks the slab cache, from
\nkmalloc-8 up to kmalloc-512.<\/p>\n
On 7.2.0-rc5 (arm64), device answering step 0 with a zero-length data
\nstage, s0 = s2 = 255:<\/p>\n
# init_on_alloc off, no spray
\n step0 window [0,255): nonzero=94\/255
\n 000: 00 80 60 06 00 00 ff ff 18 00 00 00 57 01 ea 01
\n 010: 08 78 22 13 00 00 ff ff a8 c4 5f 80 00 80 ff ff<\/p>\n
# same kernel, kmalloc-512 pre-seeded with an 8-byte tag
\n step0 window [0,255): nonzero=219\/255 tagbytes=232<\/p>\n
# identical run, init_on_alloc=1
\n step0 window [0,255): nonzero=0\/255 tagbytes=0<\/p>\n
# all three runs
\n step2 window [255,510): device words matched=62\/62<\/p>\n
a8 c4 5f 80 00 80 ff ff is the little-endian kernel text address
\nffff8000805fc4a8. The step-2 window is unaffected, so the disclosure is
\nexactly the step-0 region.<\/p>\n
Zero the buffer, and require the step-0 transfer to deliver the full
\nstep0_resp_size bytes so a short data stage is reported as an error.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: FCP: do not copy out an uninitialised init response<\/p>\n
fcp_ioctl_init() allocates its response buffer with kmalloc() and copies<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21303","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}