Messages in this thread Patch in this message |  | | | Date | Mon, 25 Oct 2010 16:58:04 -0700 | | From | Kees Cook <> | | Subject | [PATCH] ipc: explicitly clear stack memory in user structs |
| |
CVE-2010-4072
The old shm interface will leak a few bytes of stack contents. Explicitly clear structure using memset instead of C99-style initialization in case there are ever holes in the packing.
Cc: stable <stable@kernel.org> Signed-off-by: Kees Cook <kees.cook@canonical.com> --- This was originally sent as http://lkml.org/lkml/2010/10/6/486 but was never taken into any tree.
--- ipc/shm.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index 52ed77e..f943b1e 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ { struct shmid_ds out; + memset(&out, 0, sizeof(out)); ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm); out.shm_segsz = in->shm_segsz; out.shm_atime = in->shm_atime; @@ -524,6 +525,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf { struct shminfo out; + memset(&out, 0, sizeof(out)); if(in->shmmax > INT_MAX) out.shmmax = INT_MAX; else -- 1.7.1 -- Kees Cook Ubuntu Security Team
|  |