This is a note to let you know that I've just added the patch titled
xfrm_user: fix info leak in copy_to_user_auth()
to the 3.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfrm_user-fix-info-leak-in-copy_to_user_auth.patch
and it can be found in the queue-3.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From c13a67d1b857c25d64e79be02a66b81ad8765948 Mon Sep 17 00:00:00 2001
From: Mathias Krause <[email protected]>
Date: Wed, 19 Sep 2012 11:33:38 +0000
Subject: xfrm_user: fix info leak in copy_to_user_auth()
From: Mathias Krause <[email protected]>
[ Upstream commit 4c87308bdea31a7b4828a51f6156e6f721a1fcc9 ]
copy_to_user_auth() fails to initialize the remainder of alg_name and
therefore discloses up to 54 bytes of heap memory via netlink to
userland.
Use strncpy() instead of strcpy() to fill the trailing bytes of alg_name
with null bytes.
Signed-off-by: Mathias Krause <[email protected]>
Acked-by: Steffen Klassert <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/xfrm/xfrm_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -742,7 +742,7 @@ static int copy_to_user_auth(struct xfrm
return -EMSGSIZE;
algo = nla_data(nla);
- strcpy(algo->alg_name, auth->alg_name);
+ strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
algo->alg_key_len = auth->alg_key_len;
Patches currently in stable-queue which might be from [email protected] are
queue-3.5/xfrm_user-return-error-pointer-instead-of-null-2.patch
queue-3.5/xfrm_user-don-t-copy-esn-replay-window-twice-for-new-states.patch
queue-3.5/xfrm_user-fix-info-leak-in-copy_to_user_tmpl.patch
queue-3.5/xfrm_user-fix-info-leak-in-copy_to_user_auth.patch
queue-3.5/xfrm_user-return-error-pointer-instead-of-null.patch
queue-3.5/xfrm_user-fix-info-leak-in-copy_to_user_policy.patch
queue-3.5/xfrm_user-fix-info-leak-in-copy_to_user_state.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
