* [PATCH] bluetooth: cmtp: fix information leak to userland @ 2010-10-30 14:26 Vasiliy Kulikov 2010-11-02 15:35 ` Marcel Holtmann 0 siblings, 1 reply; 3+ messages in thread From: Vasiliy Kulikov @ 2010-10-30 14:26 UTC (permalink / raw) To: kernel-janitors Cc: Marcel Holtmann, Gustavo F. Padovan, David S. Miller, Eric Dumazet, linux-bluetooth, netdev, linux-kernel Structure cmtp_conninfo is copied to userland with some padding fields unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> --- Compile tested. net/bluetooth/cmtp/core.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index ec0a134..8e5f292 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -78,6 +78,7 @@ static void __cmtp_unlink_session(struct cmtp_session *session) static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci) { + memset(ci, 0, sizeof(*ci)); bacpy(&ci->bdaddr, &session->bdaddr); ci->flags = session->flags; -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] bluetooth: cmtp: fix information leak to userland 2010-10-30 14:26 [PATCH] bluetooth: cmtp: fix information leak to userland Vasiliy Kulikov @ 2010-11-02 15:35 ` Marcel Holtmann 2010-11-03 18:36 ` Gustavo F. Padovan 0 siblings, 1 reply; 3+ messages in thread From: Marcel Holtmann @ 2010-11-02 15:35 UTC (permalink / raw) To: Vasiliy Kulikov Cc: kernel-janitors, Gustavo F. Padovan, David S. Miller, Eric Dumazet, linux-bluetooth, netdev, linux-kernel Hi Vasiliy, > Structure cmtp_conninfo is copied to userland with some padding fields > unitialized. It leads to leaking of contents of kernel stack memory. > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Regards Marcel ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] bluetooth: cmtp: fix information leak to userland 2010-11-02 15:35 ` Marcel Holtmann @ 2010-11-03 18:36 ` Gustavo F. Padovan 0 siblings, 0 replies; 3+ messages in thread From: Gustavo F. Padovan @ 2010-11-03 18:36 UTC (permalink / raw) To: Marcel Holtmann Cc: Vasiliy Kulikov, kernel-janitors, David S. Miller, Eric Dumazet, linux-bluetooth, netdev, linux-kernel * Marcel Holtmann <marcel@holtmann.org> [2010-11-02 16:35:58 +0100]: > Hi Vasiliy, > > > Structure cmtp_conninfo is copied to userland with some padding fields > > unitialized. It leads to leaking of contents of kernel stack memory. > > > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> > > Acked-by: Marcel Holtmann <marcel@holtmann.org> Applied, thanks. -- Gustavo F. Padovan ProFUSION embedded systems - http://profusion.mobi ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-11-03 18:36 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2010-10-30 14:26 [PATCH] bluetooth: cmtp: fix information leak to userland Vasiliy Kulikov 2010-11-02 15:35 ` Marcel Holtmann 2010-11-03 18:36 ` Gustavo F. Padovan
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).