Bugzilla – Bug 706375
VUL-0: CVE-2009-4067: kernel: usb: buffer overflow in auerswald_probe()
Last modified: 2013-12-09 10:11:11 UTC
Your friendly security team received the following report via oss-security. Please respond ASAP. The issue is public. ------------------------------------------------------------------------------ Date: Fri, 15 Jul 2011 16:03:07 +0800 From: Eugene Teo <eugene@redhat.com> Subject: [oss-security] CVE-2009-4067 kernel: usb: buffer overflow in auerswald_probe() A buffer overflow flaw was found in the Linux kernel's Auerswald PBX/System Telephone usb driver implementation. There's no upstream patch as the affected driver was removed from the kernel in 2.6.27. For more information, check out the references: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4067 http://labs.mwrinfosecurity.com/files/Advisories/mwri_linux-usb-buffer-overflow_2009-10-29.pdf https://bugzilla.redhat.com/CVE-2009-4067
auerswald.ko is in sle10, we should simply remove it.
(In reply to comment #1) > auerswald.ko is in sle10, we should simply remove it. This will not be that easy. The driver is listed as supported. I will attach a patch which should help here in the next comment.
Created attachment 445558 [details] fix for usb_string I have not fixed the driver directly but rather looked at usb_string which can test the size sign overflow as well. What do you think Greg? Does it make sense to push this upstream? The affected driver is not there anymore but it kind of makes sense because now we are testing only for 0 size.
I guess that the issue is really minor because one would need a direct access to a HW to trigger it.
please ignore, just adjusting priority
(In reply to comment #3) > Created an attachment (id=445558) [details] > fix for usb_string > > I have not fixed the driver directly but rather looked at usb_string which can > test the size sign overflow as well. What do you think Greg? Does it make sense > to push this upstream? The affected driver is not there anymore but it kind of > makes sense because now we are testing only for 0 size. How about changing size to be ssize_t? Would that solve this better?
(In reply to comment #6) > (In reply to comment #3) > > Created an attachment (id=445558) [details] [details] > > fix for usb_string > > > > I have not fixed the driver directly but rather looked at usb_string which can > > test the size sign overflow as well. What do you think Greg? Does it make sense > > to push this upstream? The affected driver is not there anymore but it kind of > > makes sense because now we are testing only for 0 size. > > How about changing size to be ssize_t? This is basically what the patch does. It casts the give size argument to the signed type while we are testing it. Or did you mean changing usb_string function parameter? That would break the kABI as the function is exported for modules.
Should I push the patch as is into SLES10* branches?
Please do, Michal. Thanks for taking care. This is indeed minor issue though.
Pushed to SLES10_SP[34]_BRANCH and SLES10-SP3-TD branches. I guess nothing else is affected.
I forgot about SLES9_SP4_BRANCH and SLES9-SP3-TD which are affected as well. Pushed now
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (ia64) SLE-SDK 10-SP4 (ia64) SLE-SERVER 10-SP4 (ia64)
Update released for: kernel-bigsmp, kernel-bigsmp-debuginfo, kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-kdumppae, kernel-kdumppae-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-syms-debuginfo, kernel-vmi, kernel-vmi-debuginfo, kernel-vmipae, kernel-vmipae-debuginfo, kernel-xen, kernel-xen-debuginfo, kernel-xenpae, kernel-xenpae-debuginfo Products: SLE-DEBUGINFO 10-SP4 (i386) SLE-DESKTOP 10-SP4 (i386) SLE-SDK 10-SP4 (i386) SLE-SERVER 10-SP4 (i386)
Update released for: kernel-default, kernel-default-debuginfo, kernel-source, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (s390x) SLE-SERVER 10-SP4 (s390x)
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo Products: SLE-DEBUGINFO 10-SP4 (x86_64) SLE-DESKTOP 10-SP4 (x86_64) SLE-SDK 10-SP4 (x86_64) SLE-SERVER 10-SP4 (x86_64)
Update released for: kernel-default, kernel-default-debuginfo, kernel-iseries64, kernel-iseries64-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-ppc64, kernel-ppc64-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (ppc) SLE-SDK 10-SP4 (ppc) SLE-SERVER 10-SP4 (ppc)
We have just released a SUSE Linux Enterprise 10 SP4 kernel update that mentions/fixes this bug. The released version is 2.6.16.60-0.91.1.
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
The SWAMPID for this issue is 44762. This issue was rated as important. Please submit fixed packages until 2012-01-09. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
The SWAMPID for this issue is 54954. This issue was rated as moderate. Please submit fixed packages until 2013-11-20. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: kernel-default, kernel-default-debuginfo, kernel-source, kernel-syms Products: SLE-DEBUGINFO 10-SP3 (s390x) SLE-SERVER 10-SP3-LTSS (s390x)
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo Products: SLE-DEBUGINFO 10-SP3 (x86_64) SLE-SERVER 10-SP3-LTSS (x86_64)
Update released for: kernel-bigsmp, kernel-bigsmp-debuginfo, kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-kdumppae, kernel-kdumppae-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-syms-debuginfo, kernel-vmi, kernel-vmi-debuginfo, kernel-vmipae, kernel-vmipae-debuginfo, kernel-xen, kernel-xen-debuginfo, kernel-xenpae, kernel-xenpae-debuginfo Products: SLE-DEBUGINFO 10-SP3 (i386) SLE-SERVER 10-SP3-LTSS (i386)