Re: [PATCH] fix a kernel infoleak in x25 module
From: Kangjie LuDate: Sun, 8 May 2016 12:10:14 -0400 > Stack object "dte_facilities" is allocated in x25_rx_call_request(), > which is supposed to be initialized in x25_negotiate_facilities. > However, 5 fields (8 bytes in total) are not initialized. This > object is then copied to userland via copy_to_user, thus infoleak > occurs. > > Signed-off-by: Kangjie Lu Applied and queued up for -stable thanks. Please start formatting your Subject lines properly, I've been fixing all of them up by hand. You should specify a subsystem name prefix, then a ":" character, then a space, then a description of your change. For example, for this patch an appropriate Subject would have been: [PATCH] x25: Fix a kernel infoleak in x25_negotiate_facilities(). Thanks.
Re: [PATCH] fix a kernel infoleak in x25 module
From: Kangjie Lu Date: Sun, 8 May 2016 12:10:14 -0400 > Stack object "dte_facilities" is allocated in x25_rx_call_request(), > which is supposed to be initialized in x25_negotiate_facilities. > However, 5 fields (8 bytes in total) are not initialized. This > object is then copied to userland via copy_to_user, thus infoleak > occurs. > > Signed-off-by: Kangjie Lu Applied and queued up for -stable thanks. Please start formatting your Subject lines properly, I've been fixing all of them up by hand. You should specify a subsystem name prefix, then a ":" character, then a space, then a description of your change. For example, for this patch an appropriate Subject would have been: [PATCH] x25: Fix a kernel infoleak in x25_negotiate_facilities(). Thanks.
[PATCH] fix a kernel infoleak in x25 module
Stack object "dte_facilities" is allocated in x25_rx_call_request(), which is supposed to be initialized in x25_negotiate_facilities. However, 5 fields (8 bytes in total) are not initialized. This object is then copied to userland via copy_to_user, thus infoleak occurs. Signed-off-by: Kangjie Lu--- net/x25/x25_facilities.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index 2844031..a1c30c6 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -278,6 +278,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, memset(, 0, sizeof(theirs)); memcpy(new, ours, sizeof(*new)); + memset(dte, 0, sizeof(*dte)); len = x25_parse_facilities(skb, , dte, >vc_facil_mask); if (len < 0) -- 1.9.1
[PATCH] fix a kernel infoleak in x25 module
Stack object "dte_facilities" is allocated in x25_rx_call_request(), which is supposed to be initialized in x25_negotiate_facilities. However, 5 fields (8 bytes in total) are not initialized. This object is then copied to userland via copy_to_user, thus infoleak occurs. Signed-off-by: Kangjie Lu --- net/x25/x25_facilities.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index 2844031..a1c30c6 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -278,6 +278,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, memset(, 0, sizeof(theirs)); memcpy(new, ours, sizeof(*new)); + memset(dte, 0, sizeof(*dte)); len = x25_parse_facilities(skb, , dte, >vc_facil_mask); if (len < 0) -- 1.9.1