Author: gordon
Date: Tue Jan 28 18:57:45 2020
New Revision: 357219
URL: https://svnweb.freebsd.org/changeset/base/357219
Log:
Fix kernel stack data disclosure
Reported by: Ilja Van Sprundel
Approved by: so
Security: FreeBSD-SA-20:03.thrmisc
Security: CVE-2019-15875
Modified:
releng/11.3/sys/kern/imgact_elf.c
releng/12.0/sys/kern/imgact_elf.c
releng/12.1/sys/kern/imgact_elf.c
Modified: releng/11.3/sys/kern/imgact_elf.c
==============================================================================
--- releng/11.3/sys/kern/imgact_elf.c Tue Jan 28 18:56:46 2020
(r357218)
+++ releng/11.3/sys/kern/imgact_elf.c Tue Jan 28 18:57:45 2020
(r357219)
@@ -2007,7 +2007,7 @@ __elfN(note_thrmisc)(void *arg, struct sbuf *sb, size_
td = (struct thread *)arg;
if (sb != NULL) {
KASSERT(*sizep == sizeof(thrmisc), ("invalid size"));
- bzero(&thrmisc._pad, sizeof(thrmisc._pad));
+ bzero(&thrmisc, sizeof(thrmisc));
strcpy(thrmisc.pr_tname, td->td_name);
sbuf_bcat(sb, &thrmisc, sizeof(thrmisc));
}
Modified: releng/12.0/sys/kern/imgact_elf.c
==============================================================================
--- releng/12.0/sys/kern/imgact_elf.c Tue Jan 28 18:56:46 2020
(r357218)
+++ releng/12.0/sys/kern/imgact_elf.c Tue Jan 28 18:57:45 2020
(r357219)
@@ -2022,7 +2022,7 @@ __elfN(note_thrmisc)(void *arg, struct sbuf *sb, size_
td = (struct thread *)arg;
if (sb != NULL) {
KASSERT(*sizep == sizeof(thrmisc), ("invalid size"));
- bzero(&thrmisc._pad, sizeof(thrmisc._pad));
+ bzero(&thrmisc, sizeof(thrmisc));
strcpy(thrmisc.pr_tname, td->td_name);
sbuf_bcat(sb, &thrmisc, sizeof(thrmisc));
}
Modified: releng/12.1/sys/kern/imgact_elf.c
==============================================================================
--- releng/12.1/sys/kern/imgact_elf.c Tue Jan 28 18:56:46 2020
(r357218)
+++ releng/12.1/sys/kern/imgact_elf.c Tue Jan 28 18:57:45 2020
(r357219)
@@ -2211,7 +2211,7 @@ __elfN(note_thrmisc)(void *arg, struct sbuf *sb, size_
td = (struct thread *)arg;
if (sb != NULL) {
KASSERT(*sizep == sizeof(thrmisc), ("invalid size"));
- bzero(&thrmisc._pad, sizeof(thrmisc._pad));
+ bzero(&thrmisc, sizeof(thrmisc));
strcpy(thrmisc.pr_tname, td->td_name);
sbuf_bcat(sb, &thrmisc, sizeof(thrmisc));
}
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
