lkml.org 
[lkml]   [2003]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subjectinfo leak -- padded struct copied to user
From
Date
It's not OK to leak bits of the kernel stack.
(timy security flaw) I found this with -Wpadded.

diff -Naurd old/fs/stat.c new/fs/stat.c
--- old/fs/stat.c 2003-07-17 18:25:20.000000000 -0400
+++ new/fs/stat.c 2003-07-17 18:27:47.000000000 -0400
@@ -123,6 +123,7 @@
SET_OLDSTAT_UID(tmp, stat->uid);
SET_OLDSTAT_GID(tmp, stat->gid);
tmp.st_rdev = stat->rdev;
+ tmp.__pad_16bit = 0; /* don't leak kernel stack data! */
#if BITS_PER_LONG == 32
if (stat->size > MAX_NON_LFS)
return -EOVERFLOW;
diff -Naurd old/include/asm-i386/stat.h new/include/asm-i386/stat.h
--- old/include/asm-i386/stat.h 2003-06-26 17:50:47.000000000 -0400
+++ new/include/asm-i386/stat.h 2003-07-17 18:23:01.000000000 -0400
@@ -9,6 +9,7 @@
unsigned short st_uid;
unsigned short st_gid;
unsigned short st_rdev;
+ unsigned short __pad_16bit;
unsigned long st_size;
unsigned long st_atime;
unsigned long st_mtime;


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:46    [W:0.014 / U:1.696 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site