From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kangjie Lu <kjlu@gatech.edu>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.14 16/17] net: fix a kernel infoleak in x25 module
Date: Mon, 16 May 2016 18:14:17 -0700 [thread overview]
Message-ID: <20160517011347.572230108@linuxfoundation.org> (raw)
In-Reply-To: <20160517011346.950684325@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kangjie Lu <kangjielu@gmail.com>
[ Upstream commit 79e48650320e6fba48369fccf13fd045315b19b8 ]
Stack object "dte_facilities" is allocated in x25_rx_call_request(),
which is supposed to be initialized in x25_negotiate_facilities.
However, 5 fields (8 bytes in total) are not initialized. This
object is then copied to userland via copy_to_user, thus infoleak
occurs.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/x25/x25_facilities.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_b
memset(&theirs, 0, sizeof(theirs));
memcpy(new, ours, sizeof(*new));
+ memset(dte, 0, sizeof(*dte));
len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
if (len < 0)
next prev parent reply other threads:[~2016-05-17 2:03 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-17 1:14 [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 01/17] crypto: hash - Fix page length clamping in hash walk Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 02/17] get_rock_ridge_filename(): handle malformed NM entries Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 03/17] Input: max8997-haptic - fix NULL pointer dereference Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 04/17] asmlinkage, pnp: Make variables used from assembler code visible Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 05/17] drm/radeon: fix PLL sharing on DCE6.1 (v2) Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 06/17] drm/i915: Bail out of pipe config compute loop on LPT Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 07/17] ARM: OMAP3: Fix booting with thumb2 kernel Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 08/17] decnet: Do not build routes to devices without decnet private data Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 09/17] route: do not cache fib route info on local routes with oif Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 10/17] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 11/17] atl2: Disable unimplemented scatter/gather feature Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 14/17] VSOCK: do not disconnect socket when peer has shutdown SEND only Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 15/17] net: bridge: fix old ioctl unlocked net device walk Greg Kroah-Hartman
2016-05-17 1:14 ` Greg Kroah-Hartman [this message]
2016-05-17 1:14 ` [PATCH 3.14 17/17] arm64: Make arch_randomize_brk avoid stack area Greg Kroah-Hartman
2016-05-17 9:49 ` Jon Medhurst (Tixy)
2016-05-17 20:31 ` Greg Kroah-Hartman
2016-05-17 4:06 ` [PATCH 3.14 00/17] 3.14.70-stable review Guenter Roeck
2016-05-17 4:06 ` Guenter Roeck
2016-05-17 20:32 ` Greg Kroah-Hartman
2016-05-17 17:25 ` Guenter Roeck
2016-05-17 20:32 ` Greg Kroah-Hartman
2016-05-17 17:27 ` Shuah Khan
2016-05-17 20:32 ` Greg Kroah-Hartman
2016-05-17 23:10 ` Christoph Biedl
2016-05-17 23:16 ` Greg KH
2016-05-18 5:53 ` Christoph Biedl
[not found] ` <573c2d28.22c8c20a.9712f.4ddf@mx.google.com>
[not found] ` <m2k2iqzp1b.fsf@baylibre.com>
2016-05-19 3:53 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160517011347.572230108@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=kjlu@gatech.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.