Skip to content
Commit 51a0e215 authored by Szymon Heidrich's avatar Szymon Heidrich Committed by Marek Vasut
Browse files

usb: gadget: rndis: Prevent InformationBufferOffset manipulation



Prevent access to arbitrary memory locations in gen_ndis_set_resp
via manipulation of buf->InformationBufferOffset. Original
implementation permits manipulation of InformationBufferOffset to
exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents
within a 32byte offset as the devices packet filter. The packet filter
value may be next retrieved using gen_ndis_query_resp so it is possible
to extract specific memory regions two bytes a time.

The rndis_query_response was not modified as neither the buffer offset
nor length passed to gen_ndis_query_resp is used.

Signed-off-by: default avatarSzymon Heidrich <szymon.heidrich@gmail.com>
parent bcd41107
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment