Integer overflow in nitv (uint16_t) during UVC descriptor parsing -> ~250KB heap buffer overflow
Summary
uvc_drv_init_data_fmt at uvc_drv.c:1674 nitv declared uint16_t. For each FRAME descriptor nitv += bFrameIntervalType (uint8_t max 255) with NO validation that bLength contains that many dFrameInterval entries. 258 frames x bFrameIntervalType=255 -> nitv=65790 wraps to 254 mod 65536. Allocation at :1726-1731 uses wrapped value -> 9368 bytes. uvc_drv_parse_data writes 258*255=65790 intervals (263160 bytes) into undersized buffer -> ~250KB heap overflow. data->nfmt/nfrm/nitv are uint8_t fields but counters uint16_t -> silent truncation. NO validation bFrameIntervalType fits in bLength. Malicious USB webcam (UVC-class) auto-loads driver on plug-in. Attacker controls overflow length AND data (dFrameInterval values). Heap grooming -> kernel RCE/panic. Fix: validate bFrameIntervalType against bLength; widen nitv to uint32_t.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1011 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| uvc_nitv_harness.c | trigger-source | faithful replication of the nitv wrap + parse mismatch | 3.5 KB | view raw |
| build.sh | build-script | cc -O2 -Wall [-DFIXED] | 163 B | view raw |
| run.sh | run-script | runs vulnerable + fixed | 142 B | view raw |
| run.log | run-log | vulnerable: 262144-byte overflow | 322 B | view raw |
| run_fixed.log | run-log | fixed: no overflow | 277 B | view raw |
| fix.diff | suggested-fix | widen nitv to uint32 + validate bFrameIntervalType vs bLength | 1.9 KB | view raw |
| env.txt | environment | no USB devices on guest | 432 B | view raw |
| fix_build.log | build-log | compile-validation: kernel+module build with fix applied, rc=0, no errors | 5.6 MB | ↓ download |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
Fix verification
fixedcompile+harness validated
see evidence pack
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
—
Verdict
REPRODUCED (harness). uvc nitv uint16_t wrap 65790->254 -> 262KB heap overflow in parse. No USB HW.
No comments yet.