oss-security - CVE Request: tg3 VPD firmware -> driver injection

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130405140035.GD26194@suse.de>
Date: Fri, 5 Apr 2013 16:00:35 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: tg3 VPD firmware -> driver injection 

Hi,

These slides refer to (cloud) server hardware injecting code into otherwise
unsuspecting host / guest systems.

Sample is tg3 (around slide 18)
	http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf

Introduced by:
commit 184b89044fb6e2a74611dafa69b1dce0d98612c6
Author: Matt Carlson <mcarlson@...adcom.com>
Date:   Mon Apr 5 10:19:25 2010 +0000

    tg3: Use VPD fw version when present

which was added during Linux 3.2 development.

Fixed by:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=715230a44310a8cf66fbfb5a46f9a62a9b2de424

commit 715230a44310a8cf66fbfb5a46f9a62a9b2de424
Author: Kees Cook <keescook@...omium.org>
Date:   Wed Mar 27 06:40:50 2013 +0000

    tg3: fix length overflow in VPD firmware parsing
    
    Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version
    when present") introduced VPD parsing that contained a potential length
    overflow.
    
    Limit the hardware's reported firmware string length (max 255 bytes) to
    stay inside the driver's firmware string length (32 bytes). On overflow,
    truncate the formatted firmware string instead of potentially overwriting
    portions of the tg3 struct.
    
    http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf


Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.