CVE Request: tg3 VPD firmware -> driver injection

[Marcus Meissner <meissner () suse de>]

Hi,

These slides refer to (cloud) server hardware injecting code into otherwise
unsuspecting host / guest systems.

Sample is tg3 (around slide 18)
        http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf

Introduced by:
commit 184b89044fb6e2a74611dafa69b1dce0d98612c6
Author: Matt Carlson <mcarlson () broadcom com>
Date:   Mon Apr 5 10:19:25 2010 +0000

    tg3: Use VPD fw version when present

which was added during Linux 3.2 development.

Fixed by:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=715230a44310a8cf66fbfb5a46f9a62a9b2de424

commit 715230a44310a8cf66fbfb5a46f9a62a9b2de424
Author: Kees Cook <keescook () chromium org>
Date:   Wed Mar 27 06:40:50 2013 +0000

    tg3: fix length overflow in VPD firmware parsing
    
    Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version
    when present") introduced VPD parsing that contained a potential length
    overflow.
    
    Limit the hardware's reported firmware string length (max 255 bytes) to
    stay inside the driver's firmware string length (32 bytes). On overflow,
    truncate the formatted firmware string instead of potentially overwriting
    portions of the tg3 struct.
    
    http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf


Ciao, Marcus