This is a note to let you know that I've just added the patch titled
ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipvs-fix-info-leak-in-getsockopt-ip_vs_so_get_timeout.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 3b4af5fea7fc8180f427fb354a4917f395ca566b Mon Sep 17 00:00:00 2001
From: Mathias Krause <[email protected]>
Date: Wed, 15 Aug 2012 11:31:56 +0000
Subject: ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
From: Mathias Krause <[email protected]>
[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]
If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is
not set, __ip_vs_get_timeouts() does not fully initialize the structure
that gets copied to userland and that for leaks up to 12 bytes of kernel
stack. Add an explicit memset(0) before passing the structure to
__ip_vs_get_timeouts() to avoid the info leak.
Signed-off-by: Mathias Krause <[email protected]>
Cc: Wensong Zhang <[email protected]>
Cc: Simon Horman <[email protected]>
Cc: Julian Anastasov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/netfilter/ipvs/ip_vs_ctl.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2713,6 +2713,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
{
struct ip_vs_timeout_user t;
+ memset(&t, 0, sizeof(t));
__ip_vs_get_timeouts(net, &t);
if (copy_to_user(user, &t, sizeof(t)) != 0)
ret = -EFAULT;
Patches currently in stable-queue which might be from [email protected] are
queue-3.4/ipvs-fix-info-leak-in-getsockopt-ip_vs_so_get_timeout.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-via-getsockname.patch
queue-3.4/bluetooth-hci-fix-info-leak-in-getsockopt-hci_filter.patch
queue-3.4/bluetooth-hci-fix-info-leak-via-getsockname.patch
queue-3.4/atm-fix-info-leak-in-getsockopt-so_atmpvc.patch
queue-3.4/llc-fix-info-leak-via-getsockname.patch
queue-3.4/net-fix-info-leak-in-compat-dev_ifconf.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-in-getsockopt-bt_security.patch
queue-3.4/atm-fix-info-leak-via-getsockname.patch
queue-3.4/bluetooth-l2cap-fix-info-leak-via-getsockname.patch
queue-3.4/dccp-fix-info-leak-via-getsockopt-dccp_sockopt_ccid_tx_info.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-in-ioctl-rfcommgetdevlist.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
