Messages in this thread |  | | Date | Tue, 14 Aug 2018 11:21:35 +0200 | From | Greg KH <> | Subject | Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands |
| |
On Mon, Aug 13, 2018 at 03:39:08PM -0700, Suren Baghdasaryan wrote: > When handling SHDLC I-Frame commands "pipe" field used for indexing > into an array should be checked before usage. If left unchecked it > might access memory outside of the array of size NFC_HCI_MAX_PIPES(127). > > Malformed NFC HCI frames could be injected by a malicious NFC device > communicating with the device being attacked (remote attack vector), > or even by an attacker with physical access to the I2C bus such that > they could influence the data transfers on that bus (local attack vector). > skb->data is controlled by the attacker and has only been sanitized in > the most trivial ways (CRC check), therefore we can consider the > create_info struct and all of its members to tainted. 'create_info->pipe' > with max value of 255 (uint8) is used to take an offset of the > hdev->pipes array of 127 elements which can lead to OOB write. > > Suggested-by: Kevin Deus <kdeus@google.com> > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|  |