From: Eric Dumazet <eric.dumazet@gmail.com>
To: chetan loke <loke.chetan@gmail.com>
Cc: netdev@vger.kernel.org, davem@davemloft.net, kaber@trash.net,
johann.baudy@gnu-log.net, Chetan Loke <lokec@ccs.neu.edu>
Subject: Re: [af-packet 1/2] Enhance af-packet to provide (near zero)lossless packet capture functionality.
Date: Thu, 09 Jun 2011 00:22:54 +0200 [thread overview]
Message-ID: <1307571774.3980.7.camel@edumazet-laptop> (raw)
In-Reply-To: <BANLkTi=_EFRaiPuT=OjwRaJ4XPw0sUhcnA@mail.gmail.com>
Le mercredi 08 juin 2011 à 18:10 -0400, chetan loke a écrit :
> Eric, thanks for pointing that. I will add the padding. But just out
> of curiosity, how is the information being leaked in tpacket_rcv()?
>
> If someone is capturing packets then they have access to all the data
> anyways. Also, tpacket_rcv doesn't memset the frame-element to 'zero'
> before calling
> skb_copy_bits(). And we would never want to memset anyways.
>
Its a security risk, leaking content of kernel stack or kernel memory.
capturing packets capability is not meaning "accessing full memory"
Some clever hackers can exploit these kind of leaks.
Better make sure we dont have holes in structures copied to user.
(or mapped in this case, but you never knows ;) )
next prev parent reply other threads:[~2011-06-08 22:22 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-08 3:13 [af-packet 0/2] Enhance af-packet to provide (near zero)lossless packet capture functionality Chetan Loke
2011-06-08 3:13 ` [af-packet 1/2] " Chetan Loke
2011-06-08 4:35 ` Eric Dumazet
2011-06-08 22:10 ` chetan loke
2011-06-08 22:22 ` Eric Dumazet [this message]
2011-06-08 16:03 ` Stephen Hemminger
2011-06-08 3:13 ` [af-packet 2/2] " Chetan Loke
2011-06-08 4:18 ` Joe Perches
2011-06-08 22:01 ` chetan loke
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1307571774.3980.7.camel@edumazet-laptop \
--to=eric.dumazet@gmail.com \
--cc=davem@davemloft.net \
--cc=johann.baudy@gnu-log.net \
--cc=kaber@trash.net \
--cc=loke.chetan@gmail.com \
--cc=lokec@ccs.neu.edu \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox