[patch 23/47] net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2

Greg KH
2009-02-14T01:09:53Z

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: net-4-bytes-kernel-memory-disclosure-in-so_bsdcompat-gsopt-try-2.patch --]
[-- Type: text/plain; charset=utf-8, Size: 1199 bytes --]

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Clément Lecigne <clement.lecigne@netasq.com>

[ Upstream commit df0bca049d01c0ee94afb7cd5dfd959541e6c8da ]

In function sock_getsockopt() located in net/core/sock.c, optval v.val
is not correctly initialized and directly returned in userland in case
we have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
unsigned char buf[4] = { 0, 0, 0, 0 };
int len;
int sock;
sock = socket(33, 2, 2);
getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its
declaration.

Signed-off-by: Clement Lecigne <clement.lecigne@netasq.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/core/sock.c | 2 ++
1 file changed, 2 insertions(+)

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -695,6 +695,8 @@ int sock_getsockopt(struct socket *sock,
if (len < 0)
return -EINVAL;

+ v.val = 0;
+
switch(optname) {
case SO_DEBUG:
v.val = sock_flag(sk, SOCK_DBG);