Return-Path: Subject: Re: [PATCH] HID: Bluetooth: hidp: buffer overflow in hidp_process_report To: Greg KH Cc: linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , "David S. Miller" , Kees Cook , Benjamin Tissoires , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, stable , kernel-team@android.com, Jiri Kosina References: <20180731220225.159741-1-salyzyn@android.com> <20180801163703.GA6994@kroah.com> From: Mark Salyzyn Message-ID: <6f6c3e63-0847-b0b6-98a3-7ad62fd2697c@android.com> Date: Wed, 1 Aug 2018 09:41:04 -0700 MIME-Version: 1.0 In-Reply-To: <20180801163703.GA6994@kroah.com> Content-Type: text/plain; charset=utf-8; format=flowed List-ID: On 08/01/2018 09:37 AM, Greg KH wrote: > On Tue, Jul 31, 2018 at 03:02:13PM -0700, Mark Salyzyn wrote: >> CVE-2018-9363 >> >> The buffer length is unsigned at all layers, but gets cast to int and >> checked in hidp_process_report and can lead to a buffer overflow. >> Switch len parameter to unsigned int to resolve issue. >> >> This affects 3.18 and newer kernels. >> >> Signed-off-by: Mark Salyzyn >> Fixes: a4b1b5877b514b276f0f31efe02388a9c2836728 ("HID: Bluetooth: hidp: make sure input buffers are big enough") >> Cc: Marcel Holtmann >> Cc: Johan Hedberg >> Cc: "David S. Miller" >> Cc: Kees Cook >> Cc: Benjamin Tissoires >> Cc: linux-bluetooth@vger.kernel.org >> Cc: netdev@vger.kernel.org >> Cc: linux-kernel@vger.kernel.org >> Cc: security@kernel.org >> Cc: kernel-team@android.com > Nit, you only need to bother security@ if you do not have a fix and need > to figure out one. Thanks, I thought anything with a CVE was to go there according to netdev FAQ (dropped security from response list). > Also, you forgot to cc: stable@vger.kernel.org to be included in older > kernel releases :( netdev FAQ said to _not_ copy stable, I am so confused ;-{ (added stable to response list b/c patch is now taken into bluetooth-next) > thanks, > > greg k-h