From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kangjie Lu Subject: [PATCH] fix a kernel infoleak in x25 module Date: Sun, 8 May 2016 12:10:14 -0400 Message-ID: <1462723814-14732-1-git-send-email-kjlu@gatech.edu> Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=+gzikGPmX/bbI3f4jXMGECjirBC5i0gC+iOcIth70TU=; b=XJvuOpBLAsASl/0/h4XtppQ6qGa3wThdTbUcPR/m7AoQVZADGK+KasvTYJOLATxQyw Jx/EVwNLtsc/xHNFNjDkkdHvROHKvT+96hwBihrKoanZki77z2QRxIVcuA3DKHWKp+wZ b6Fc67Bkc0bQ1AHByRW2cFQmi1mNyjtdhSmv5lrpN7dh8rykviRcvSku884HY38HwcDV L3wBDoUw0HnmTBtRykZkGCIIAzxtWCVcfpDCzBS6tMG+0kyzUGx6iNywEEgqQO89Vl0S Joql/XFY6VEkp0/nOl/iIqXLuO1FO0iHM0Tm8GRLSQR0kdBahCrkWr+lcjREv6uNNxH6 sYOQ== Sender: linux-kernel-owner@vger.kernel.org List-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: andrew.hendry@gmail.com Cc: davem@davemloft.net, linux-x25@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, taesoo@gatech.edu, insu@gatech.edu, csong84@gatech.edu, Kangjie Lu Stack object "dte_facilities" is allocated in x25_rx_call_request(), which is supposed to be initialized in x25_negotiate_facilities. However, 5 fields (8 bytes in total) are not initialized. This object is then copied to userland via copy_to_user, thus infoleak occurs. Signed-off-by: Kangjie Lu --- net/x25/x25_facilities.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index 2844031..a1c30c6 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -278,6 +278,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, memset(&theirs, 0, sizeof(theirs)); memcpy(new, ours, sizeof(*new)); + memset(dte, 0, sizeof(*dte)); len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); if (len < 0) -- 1.9.1