From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH] isdn: Disable IIOCDBGVAR Date: Thu, 16 Aug 2018 12:26:44 -0700 (PDT) Message-ID: <20180816.122644.863787126693940698.davem@davemloft.net> References: <20180815191405.GA29528@beast> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: viro@zeniv.linux.org.uk, isdn@linux-pingi.de, linux-kernel@vger.kernel.org, netdev@vger.kernel.org To: keescook@chromium.org Return-path: In-Reply-To: <20180815191405.GA29528@beast> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org From: Kees Cook Date: Wed, 15 Aug 2018 12:14:05 -0700 > It was possible to directly leak the kernel address where the isdn_dev > structure pointer was stored. This is a kernel ASLR bypass for anyone > with access to the ioctl. The code had been present since the beginning > of git history, though this shouldn't ever be needed for normal operation, > therefore remove it. > > Reported-by: Al Viro > Cc: Karsten Keil > Signed-off-by: Kees Cook > --- > netdev doesn't like explict stable markings, so I'll just ask here that it > get included in -stable please. :) Applied and queued up for -stable, thanks :)