oss-security - Re: Re: CVE-2016-5400 - linux kernel: denial of service in airspy USB driver.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87d1lyiuhk.fsf@camandro.org>
Date: Wed, 27 Jul 2016 23:31:03 +0100
From: Luis Henriques <henrix@...andro.org>
To: Wade Mealing <wmealing@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2016-5400 - linux kernel: denial of service in airspy USB driver.

Wade Mealing <wmealing@...hat.com> writes:

> Hit send too early,
>
>
> Upstream patch:
> https://git.linuxtv.org/media_tree.git/commit/?id=eca2d34b9d2ce70165a50510659838e28ca22742
>

I believe the above commit isn't really related with CVE-2016-5400;
the following commit in mainline claims to fix this issue:

commit aa93d1fee85c890a34f2510a310e55ee76a27848
Author: James Patrick-Evans <james@...-e.com>
Date:   Fri Jul 15 16:40:45 2016 +0100

    media: fix airspy usb probe error path

Cheers,
-- 
Luís

> Maintainer has yet to send to LKML.
>
>
> On Mon, Jul 25, 2016 at 10:50 AM, Wade Mealing <wmealing@...hat.com> wrote:
>> Hello All,
>>
>> A flaw was found in the linux kernel's implementation of the airspy
>> USB device driver in which a leak was found when a subdev or SDR are
>> plugged into the host.
>>
>> An attacker can create an targeted USB device which can emulate 64 of
>> these devices. Then by emulating an additional device which
>> continuously connects and disconnects, each connection attempt will
>> leak memory which can not be recovered.
>>
>> This issue was assigned CVE-2016-5400.
>>
>> Wade Mealing
>> Red Hat Product Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.