Messages in this thread | | | Date | Thu, 12 Feb 2009 16:59:24 -0800 (PST) | Subject | Re: [PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2 | From | David Miller <> |
| |
From: Clement LECIGNE <clement.lecigne@netasq.com> Date: Thu, 12 Feb 2009 13:35:45 +0100
> In function sock_getsockopt() located in net/core/sock.c, optval v.val > is not correctly initialized and directly returned in userland in case > we have SO_BSDCOMPAT option set. > > This dummy code should trigger the bug: > > int main(void) > { > unsigned char buf[4] = { 0, 0, 0, 0 }; > int len; > int sock; > sock = socket(33, 2, 2); > getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len); > printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]); > close(sock); > } > > Here is a patch that fix this bug by initalizing v.val just after its declaration.
Applied, thank you.
| |