lkml.org 
[lkml]   [2012]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 023/262] net: fix info leak in compat dev_ifconf()
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.5-stable review patch. If anyone has any objections, please let me know.

    ------------------


    From: Mathias Krause <minipli@googlemail.com>

    [ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]

    The implementation of dev_ifconf() for the compat ioctl interface uses
    an intermediate ifc structure allocated in userland for the duration of
    the syscall. Though, it fails to initialize the padding bytes inserted
    for alignment and that for leaks four bytes of kernel stack. Add an
    explicit memset(0) before filling the structure to avoid the info leak.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/socket.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/socket.c
    +++ b/net/socket.c
    @@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, s
    if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
    return -EFAULT;

    + memset(&ifc, 0, sizeof(ifc));
    if (ifc32.ifcbuf == 0) {
    ifc32.ifc_len = 0;
    ifc.ifc_len = 0;



    \
     
     \ /
      Last update: 2012-09-29 00:41    [W:7.208 / U:0.456 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site