CVS commit: src/sys/dev/usb

["Maxime Villard" <maxv%netbsd.org@localhost>]

Module Name:    src
Committed By:   maxv
Date:           Wed Jan  1 09:03:00 UTC 2020

Modified Files:
        src/sys/dev/usb: uthum.c

Log Message:
Fix buffer overflows. sc_{o,f}len are controlled by the USB device. By
crafting the former the device can leak stack data. By crafting the latter
the device can overwrite the stack. The combination of the two means the
device can ROP the kernel and obtain code execution (demonstrated with an
actual exploit over vHCI).

Truncate the lengths to the size of the buffers, and also drop sc_ilen
since it is unused. Patch tested with vHCI+kASan.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 src/sys/dev/usb/uthum.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.