upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-19 02:30:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/sys/dev/mpr
History
Ed Maste 1289cbfc18 mpr/mps/mpt: verify cfg page ioctl lengths 
*_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a
buffer of a caller-specified size, but copied to it a fixed size header.
Add checks that the size is at least the required minimum.

Note that the device nodes are owned by root:operator with 0640
permissions so the ioctls are not available to unprivileged users.

This change includes suggestions from scottl, markj and mav.

Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of
Trend Micro Zero Day Initiative; scottl reported the third case in mpt.
Same issue found in mpr and mps after discussion with imp.

Reported by:	Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative
Reviewed by:	imp, mav
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D34692

(cherry picked from commit 8276c4149b)
(cherry picked from commit 0b29e1b9f9)

Approved by:	so
Security:	CVE-2022-23086
Security:	FreeBSD-SA-22:06.ioctl
2022-04-06 08:05:11 +02:00
..
mpi mpr: clean up empty lines in .c and .h files 2020-09-01 22:07:12 +00:00
mpr.c mpr(4): Fix a typo in a source code comment 2021-12-03 16:52:17 +01:00
mpr_config.c mpr: big-endian support 2021-03-09 21:09:24 -03:00
mpr_ioctl.h mpr: clean up empty lines in .c and .h files 2020-09-01 22:07:12 +00:00
mpr_mapping.c mpr/mps(4): Make device mapping some more robust. 2021-05-24 10:43:39 -04:00
mpr_mapping.h Update copyright information 2018-12-26 10:43:31 +00:00
mpr_pci.c Refine the busdma template interface. Provide tools for filling in fields 2020-09-14 05:58:12 +00:00
mpr_sas.c Fix "set but not used" warnings in the mpr driver. This fixes a minor 2022-01-06 14:08:50 -05:00
mpr_sas.h mpr(4): Handle mprsas_alloc_tm() errors on device removal. 2021-09-02 20:35:27 -04:00
mpr_sas_lsi.c Fix "set but not used" warnings in the mpr driver. This fixes a minor 2022-01-06 14:08:50 -05:00
mpr_table.c Fix "set but not used" warnings in the mpr driver. This fixes a minor 2022-01-06 14:08:50 -05:00
mpr_table.h Convert some in-line printing of diagnostic into tables. 2017-09-09 22:02:36 +00:00
mpr_user.c mpr/mps/mpt: verify cfg page ioctl lengths 2022-04-06 08:05:11 +02:00
mprvar.h mpr(4): Handle mprsas_alloc_tm() errors on device removal. 2021-09-02 20:35:27 -04:00