* Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak
@ 2017-08-03 14:00 sohu0106
0 siblings, 0 replies; only message in thread
From: sohu0106 @ 2017-08-03 14:00 UTC (permalink / raw)
To: netdev
Sometimes irda_getsockopt() doesn't initialize all members of list field of irda_device_list struct. This structure is then copied to
userland. It leads to leaking of contents of kernel stack memory.
2 net/irda/af_irda.c
@@ -2248,6 +2248,8 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
err = -EINVAL;
goto out;
}
+
+ memset( &list, 0, sizeof(struct irda_device_list) );
/* Ask lmp for the current discovery log */
discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2017-08-03 14:00 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-03 14:00 Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak sohu0106
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox