Re: Re: CVE-2016-5400 - linux kernel: denial of service in airspy USB driver.

[Luis Henriques <henrix () camandro org>]

Wade Mealing <wmealing () redhat com> writes:

> Hit send too early,
>
>
> Upstream patch:
> https://git.linuxtv.org/media_tree.git/commit/?id=eca2d34b9d2ce70165a50510659838e28ca22742

I believe the above commit isn't really related with CVE-2016-5400;
the following commit in mainline claims to fix this issue:

commit aa93d1fee85c890a34f2510a310e55ee76a27848
Author: James Patrick-Evans <james () jmp-e com>
Date:   Fri Jul 15 16:40:45 2016 +0100

    media: fix airspy usb probe error path

Cheers,
-- 
Luís


> Maintainer has yet to send to LKML.
>
>
> On Mon, Jul 25, 2016 at 10:50 AM, Wade Mealing <wmealing () redhat com> wrote:
> > Hello All,
> >
> > A flaw was found in the linux kernel's implementation of the airspy
> > USB device driver in which a leak was found when a subdev or SDR are
> > plugged into the host.
> >
> > An attacker can create an targeted USB device which can emulate 64 of
> > these devices. Then by emulating an additional device which
> > continuously connects and disconnects, each connection attempt will
> > leak memory which can not be recovered.
> >
> > This issue was assigned CVE-2016-5400.
> >
> > Wade Mealing
> > Red Hat Product Security Team