This is a note to let you know that I've just added the patch titled
rose: fix info leak via msg_name in rose_recvmsg()
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rose-fix-info-leak-via-msg_name-in-rose_recvmsg.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 9134fcea8aac307bda6254cca8033b4857564316 Mon Sep 17 00:00:00 2001
From: Mathias Krause <[email protected]>
Date: Sun, 7 Apr 2013 01:51:59 +0000
Subject: rose: fix info leak via msg_name in rose_recvmsg()
From: Mathias Krause <[email protected]>
[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ]
The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.
Fix the issue by initializing the memory used for sockaddr info with
memset(0).
Signed-off-by: Mathias Krause <[email protected]>
Cc: Ralf Baechle <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/rose/af_rose.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1258,6 +1258,7 @@ static int rose_recvmsg(struct kiocb *io
skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (srose != NULL) {
+ memset(srose, 0, msg->msg_namelen);
srose->srose_family = AF_ROSE;
srose->srose_addr = rose->dest_addr;
srose->srose_call = rose->dest_call;
Patches currently in stable-queue which might be from [email protected] are
queue-3.0/irda-fix-missing-msg_namelen-update-in-irda_recvmsg_dgram.patch
queue-3.0/bluetooth-rfcomm-fix-missing-msg_namelen-update-in-rfcomm_sock_recvmsg.patch
queue-3.0/llc-fix-missing-msg_namelen-update-in-llc_ui_recvmsg.patch
queue-3.0/atm-update-msg_namelen-in-vcc_recvmsg.patch
queue-3.0/iucv-fix-missing-msg_namelen-update-in-iucv_sock_recvmsg.patch
queue-3.0/ax25-fix-info-leak-via-msg_name-in-ax25_recvmsg.patch
queue-3.0/tipc-fix-info-leaks-via-msg_name-in-recv_msg-recv_stream.patch
queue-3.0/netrom-fix-info-leak-via-msg_name-in-nr_recvmsg.patch
queue-3.0/caif-fix-missing-msg_namelen-update-in-caif_seqpkt_recvmsg.patch
queue-3.0/bluetooth-fix-possible-info-leak-in-bt_sock_recvmsg.patch
queue-3.0/rose-fix-info-leak-via-msg_name-in-rose_recvmsg.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
