This is a note to let you know that I've just added the patch titled
net: fix info leak in compat dev_ifconf()
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-fix-info-leak-in-compat-dev_ifconf.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 5d925ae211c8c2f62e869f6259633da56944e48e Mon Sep 17 00:00:00 2001
From: Mathias Krause <[email protected]>
Date: Wed, 15 Aug 2012 11:31:57 +0000
Subject: net: fix info leak in compat dev_ifconf()
From: Mathias Krause <[email protected]>
[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]
The implementation of dev_ifconf() for the compat ioctl interface uses
an intermediate ifc structure allocated in userland for the duration of
the syscall. Though, it fails to initialize the padding bytes inserted
for alignment and that for leaks four bytes of kernel stack. Add an
explicit memset(0) before filling the structure to avoid the info leak.
Signed-off-by: Mathias Krause <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/socket.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/socket.c
+++ b/net/socket.c
@@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, s
if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
return -EFAULT;
+ memset(&ifc, 0, sizeof(ifc));
if (ifc32.ifcbuf == 0) {
ifc32.ifc_len = 0;
ifc.ifc_len = 0;
Patches currently in stable-queue which might be from [email protected] are
queue-3.4/ipvs-fix-info-leak-in-getsockopt-ip_vs_so_get_timeout.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-via-getsockname.patch
queue-3.4/bluetooth-hci-fix-info-leak-in-getsockopt-hci_filter.patch
queue-3.4/bluetooth-hci-fix-info-leak-via-getsockname.patch
queue-3.4/atm-fix-info-leak-in-getsockopt-so_atmpvc.patch
queue-3.4/llc-fix-info-leak-via-getsockname.patch
queue-3.4/net-fix-info-leak-in-compat-dev_ifconf.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-in-getsockopt-bt_security.patch
queue-3.4/atm-fix-info-leak-via-getsockname.patch
queue-3.4/bluetooth-l2cap-fix-info-leak-via-getsockname.patch
queue-3.4/dccp-fix-info-leak-via-getsockopt-dccp_sockopt_ccid_tx_info.patch
queue-3.4/bluetooth-rfcomm-fix-info-leak-in-ioctl-rfcommgetdevlist.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
