Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[LTS 8.8 RT] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_… #127

Closed
wants to merge 1 commit into from

Conversation

gvrose8192
Copy link
Collaborator

jira VULN-9664
cve CVE-2024-53104
commit-author Benoit Sevens [email protected]
commit ecf2b43

This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Fixes: c0efd23 ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens [email protected]
Cc: [email protected]
Acked-by: Greg Kroah-Hartman [email protected]
Reviewed-by: Laurent Pinchart [email protected]
Signed-off-by: Hans Verkuil [email protected]
(cherry picked from commit ecf2b43)
Signed-off-by: Greg Rose [email protected]

Builds and Loads
Already up to date. configs/kernel-rt-4.18.0-x86_64.config:CONFIG_PREEMPT_RT=y configs/kernel-rt-4.18.0-x86_64-debug.config:CONFIG_PREEMPT_RT=y configs/kernel-rt-x86_64.config:# CONFIG_PREEMPT_RTB is not set configs/kernel-rt-x86_64.config:CONFIG_PREEMPT_RT=y configs/kernel-rt-x86_64-debug.config:# CONFIG_PREEMPT_RTB is not set configs/kernel-rt-x86_64-debug.config:CONFIG_PREEMPT_RT=y skipkabi is true /home/gvrose8192/prj/kernel-build-gvrose_ciqlts8_8-rt no .config file found, moving on [TIMER]{MRPROPER}: 0s x86_64 architecture detected, copying config 'configs/kernel-rt-4.18.0-x86_64.config' -> '.config' Setting Local Version for build CONFIG_LOCALVERSION="-gvrose_ciqlts8_8-rt" Making olddefconfig HOSTCC scripts/basic/fixdep HOSTCC scripts/kconfig/conf.o YACC scripts/kconfig/zconf.tab.c LEX scripts/kconfig/zconf.lex.c HOSTCC scripts/kconfig/zconf.tab.o HOSTLD scripts/kconfig/conf scripts/kconfig/conf --olddefconfig Kconfig
kABI check is skipped due to RT kernel ABI instability

[SNIP]

INSTALL sound/usb/snd-usbmidi-lib.ko INSTALL sound/usb/usx2y/snd-usb-us122l.ko INSTALL sound/usb/usx2y/snd-usb-usx2y.ko INSTALL sound/virtio/virtio_snd.ko INSTALL sound/x86/snd-hdmi-lpe-audio.ko INSTALL virt/lib/irqbypass.ko DEPMOD 4.18.0-gvrose_ciqlts8_8-rt+ [TIMER]{MODULES}: 81s Making Install sh ./arch/x86/boot/install.sh 4.18.0-gvrose_ciqlts8_8-rt+ arch/x86/boot/bzImage \ System.map "/boot" [TIMER]{INSTALL}: 32s Checking kABI kABI check skipped Setting Default Kernel to /boot/vmlinuz-4.18.0-gvrose_ciqlts8_8-rt+ and Index to 0 Hopefully Grub2.0 took everything ... rebooting after time metrices [TIMER]{MRPROPER}: 0s [TIMER]{BUILD}: 4870s [TIMER]{MODULES}: 81s [TIMER]{INSTALL}: 32s [TIMER]{TOTAL} 5004s Rebooting in 10 seconds
[gvrose8192@auto-kernel-test-88lts-rt ~]$ uname -a Linux auto-kernel-test-88lts-rt 4.18.0-gvrose_ciqlts8_8-rt+ #1 SMP PREEMPT_RT Wed Feb 12 20:24:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Note that this PR is using the newer kernel automation tests available in kernel-tools under the 'gvrose_more_automation' branch.

Full command and build logs attached.
lts-8_8-rt-commands.log
lts-8_8-rt-build.log

…parse_format

jira VULN-9664
cve CVE-2024-53104
commit-author Benoit Sevens <[email protected]>
commit ecf2b43

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.

Fixes: c0efd23 ("V4L/DVB (8145a): USB Video Class driver")
	Signed-off-by: Benoit Sevens <[email protected]>
	Cc: [email protected]
	Acked-by: Greg Kroah-Hartman <[email protected]>
	Reviewed-by: Laurent Pinchart <[email protected]>
	Signed-off-by: Hans Verkuil <[email protected]>
(cherry picked from commit ecf2b43)
	Signed-off-by: Greg Rose <[email protected]>
@gvrose8192 gvrose8192 changed the title media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_… [LTS 8.8 RT] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_… Feb 13, 2025
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@gvrose8192
Copy link
Collaborator Author

Merged via git cli merge -ff

@gvrose8192 gvrose8192 closed this Feb 14, 2025
@gvrose8192 gvrose8192 deleted the gvrose_ciqlts8_8-rt branch February 14, 2025 01:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants