From mboxrd@z Thu Jan 1 00:00:00 1970 From: Simon Horman Date: Mon, 10 Jun 2013 08:38:50 +0000 Subject: Re: [patch] ipvs: info leak in __ip_vs_get_dest_entries() Message-Id: <20130610083849.GD1563@verge.net.au> List-Id: References: <20130603090049.GA16171@debian> In-Reply-To: <20130603090049.GA16171@debian> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dan Carpenter , Pablo Neira Ayuso Cc: Wensong Zhang , Julian Anastasov , Patrick McHardy , Jozsef Kadlecsik , "David S. Miller" , netdev@vger.kernel.org, lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org, coreteam@netfilter.org, kernel-janitors@vger.kernel.org On Mon, Jun 03, 2013 at 12:00:49PM +0300, Dan Carpenter wrote: > The entry struct has a 2 byte hole after ->port and another 4 byte > hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your > namespace to hit this information leak. > > Signed-off-by: Dan Carpenter Signed-off-by: Simon Horman Pablo, could you take this directly into your tree. If possible for v3.10. It also appears to be relevant for stable. > > diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c > index df05c1c..e336535 100644 > --- a/net/netfilter/ipvs/ip_vs_ctl.c > +++ b/net/netfilter/ipvs/ip_vs_ctl.c > @@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get, > struct ip_vs_dest *dest; > struct ip_vs_dest_entry entry; > > + memset(&entry, 0, sizeof(entry)); > list_for_each_entry(dest, &svc->destinations, n_list) { > if (count >= get->num_dests) > break; > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >