From: Young Xiao Date: Fri, 12 Apr 2019 07:24:30 +0000 (+0800) Subject: Bluetooth: hidp: fix buffer overflow X-Git-Tag: archive/raspbian/5.2.17-1+rpi1^2^2^2^2~50 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=38234935618ed8293096a5a51b1db71e342a30d4;p=linux.git Bluetooth: hidp: fix buffer overflow Struct ca is copied from userspace. It is not checked whether the "name" field is NULL terminated, which allows local users to obtain potentially sensitive information from kernel stack memory, via a HIDPCONNADD command. This vulnerability is similar to CVE-2011-1079. Signed-off-by: Young Xiao Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org Gbp-Pq: Topic bugfix/all Gbp-Pq: Name Bluetooth-hidp-fix-buffer-overflow.patch --- diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c index 1eaac01f85d..7f36fa73ffe 100644 --- a/net/bluetooth/hidp/sock.c +++ b/net/bluetooth/hidp/sock.c @@ -76,6 +76,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long sockfd_put(csock); return err; } + ca.name[sizeof(ca.name)-1] = 0; err = hidp_connection_add(&ca, csock, isock); if (!err && copy_to_user(argp, &ca, sizeof(ca)))