Messages in this thread | | | From | Thomas Gleixner <> | Subject | Re: Potential information leak in save_xstate_epilog() | Date | Sat, 27 Nov 2021 21:26:04 +0100 |
| |
On Fri, Nov 26 2021 at 12:06, Alexander Potapenko wrote: > Hi Chang, Thomas, Borislav, > > "x86/fpu/signal: Prepare for variable sigframe length" has presumably > introduced an information leak to the userspace. > > According to https://elixir.bootlin.com/linux/v5.16-rc2/source/arch/x86/kernel/fpu/signal.c#L126, > save_sw_bytes() only initializes the first 20 bytes of sw_bytes, but > then the whole struct is copied to the userspace.
Yes, that clearly lacks a memset(0).
Thanks,
tglx
| |