Staging: vt6655/vt6656 security issues

[Dan Rosenberg]

Based on a brief glance looking for security issues, I just wanted to
mention that these drivers are nowhere near ready to be added to the
main kernel.  I'm not interested in developing these drivers further,
but there are at least six stack buffer overflows:

vt6655/wpactl.c: wpa_set_keys(), line 239
vt6655/wpactl.c: wpa_set_keys(), line 280
vt6655/wpactl.c: wpa_set_associate(), line 770 (reported by Dan
Carpenter)

vt6656/wpactl.c: wpa_set_keys(), line 239
vt6656/wpactl.c: wpa_set_keys(), line 279
vt6656/wpactl.c: wpa_set_associate(), line 779

And four heap corruption issues due to integer overflow in the
allocation size:

vt6655/ioctl.c: private_ioctl(), line 329
vt6655/ioctl.c: private_ioctl(), line 625

vt6656/ioctl.c: private_ioctl(), line 326
vt6656/ioctl.c: private_ioctl(), line 615

They are all caused by unchecked copy_from_user() calls with
user-provided length fields or kmalloc() calls with arithmetic on
user-provided sizes.  This kind of sloppiness suggests there are almost
certainly other major security issues in this code.

Regards,
Dan

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/