rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

qseecom: check invalid handle for app loaded query request

Browse Source 
Check if the handle data type received from userspace is valid
for app loaded query request to avoid the offset boundary check
for qseecom_send_modfd_resp is bypassed.

Bug: 143972932
Change-Id: I5f3611a8f830d6904213781c5ba70cfc0ba3e2e0
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
CVE-2019-14041
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Zhen Kong
2020-05-20 09:44:44 +02:00
committed by Francescodario Cuzzocrea
parent b2e0d99b7b
commit 470ff23716
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/misc/qseecom.c
+7
View File
@@ -4188,6 +4188,13 @@ static long qseecom_ioctl(struct file *file, unsigned cmd,
break;
}
case QSEECOM_IOCTL_APP_LOADED_QUERY_REQ: {
if ((data->type != QSEECOM_GENERIC) &&
(data->type != QSEECOM_CLIENT_APP)) {
pr_err("app loaded query req: invalid handle (%d)\n",
data->type);
ret = -EINVAL;
break;
}
data->type = QSEECOM_CLIENT_APP;
pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%x\n", (u32)data);
mutex_lock(&app_access_lock);