Bluetooth: hidp: fix buffer overflow

Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.

This vulnerability is similar to CVE-2011-1079.

Signed-off-by: Young Xiao <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>
Cc: [email protected]

diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 9f85a1943be9b6b6ed06a61fe4a830b233f82ec5..2151913892ce8705d093a96fa65c3888e8a6dbb1 100644 (file)
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -75,6 +75,7 @@ static int do_hidp_sock_ioctl(struct socket *sock, unsigned int cmd, void __user
                        sockfd_put(csock);
                        return err;
                }
+               ca.name[sizeof(ca.name)-1] = 0;
 
                err = hidp_connection_add(&ca, csock, isock);
                if (!err && copy_to_user(argp, &ca, sizeof(ca)))