Date: Fri, 5 Apr 2013 16:00:35 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: CVE Request: tg3 VPD firmware -> driver injection Hi, These slides refer to (cloud) server hardware injecting code into otherwise unsuspecting host / guest systems. Sample is tg3 (around slide 18) http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf Introduced by: commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 Author: Matt Carlson <mcarlson@...adcom.com> Date: Mon Apr 5 10:19:25 2010 +0000 tg3: Use VPD fw version when present which was added during Linux 3.2 development. Fixed by: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=715230a44310a8cf66fbfb5a46f9a62a9b2de424 commit 715230a44310a8cf66fbfb5a46f9a62a9b2de424 Author: Kees Cook <keescook@...omium.org> Date: Wed Mar 27 06:40:50 2013 +0000 tg3: fix length overflow in VPD firmware parsing Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version when present") introduced VPD parsing that contained a potential length overflow. Limit the hardware's reported firmware string length (max 255 bytes) to stay inside the driver's firmware string length (32 bytes). On overflow, truncate the formatted firmware string instead of potentially overwriting portions of the tg3 struct. http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ