cx82310_rx_fixup() saves partially received packets and attempts to complete them with data from the next USB transfer. However, it does not check that the new skb contains enough data to supply the remaining bytes (dev->partial_rem). The memcpy at the reassembly site blindly copies partial_rem bytes from skb->data, which can read beyond the skb data buffer when a malicious or malfunctioning USB device sends a transfer shorter than expected. A crafted USB device can exploit this by first sending a packet header claiming a large payload but providing only a few bytes (setting up a large partial_rem), then sending a very short follow-up transfer. The memcpy reads past the skb data into adjacent heap memory, and the resulting over-long frame is delivered to the network stack via usbnet_skb_return(), potentially leaking kernel heap contents. Add a check that skb->len >= partial_rem before the reassembly memcpy. When the transfer is too short, reset partial_rem and drop the frame. Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver") Signed-off-by: Aamir Ahmed --- drivers/net/usb/cx82310_eth.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c index 068acb052adb0..e243898917fdb 100644 --- a/drivers/net/usb/cx82310_eth.c +++ b/drivers/net/usb/cx82310_eth.c @@ -251,6 +251,10 @@ static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb) * end of that packet at the beginning. */ if (dev->partial_rem) { + if (skb->len < dev->partial_rem) { + dev->partial_rem = 0; + return 0; + } len = dev->partial_len + dev->partial_rem; skb2 = alloc_skb(len, GFP_ATOMIC); if (!skb2) -- 2.43.0