lkml.org 
[lkml]   [2010]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] ipc: explicitly clear stack memory in user structs
    CVE-2010-4072

    The old shm interface will leak a few bytes of stack contents. Explicitly
    clear structure using memset instead of C99-style initialization in case
    there are ever holes in the packing.

    Cc: stable <stable@kernel.org>
    Signed-off-by: Kees Cook <kees.cook@canonical.com>
    ---

    This was originally sent as http://lkml.org/lkml/2010/10/6/486 but was
    never taken into any tree.

    ---
    ipc/shm.c | 2 ++
    1 files changed, 2 insertions(+), 0 deletions(-)

    diff --git a/ipc/shm.c b/ipc/shm.c
    index 52ed77e..f943b1e 100644
    --- a/ipc/shm.c
    +++ b/ipc/shm.c
    @@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
    {
    struct shmid_ds out;

    + memset(&out, 0, sizeof(out));
    ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
    out.shm_segsz = in->shm_segsz;
    out.shm_atime = in->shm_atime;
    @@ -524,6 +525,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
    {
    struct shminfo out;

    + memset(&out, 0, sizeof(out));
    if(in->shmmax > INT_MAX)
    out.shmmax = INT_MAX;
    else
    --
    1.7.1
    --
    Kees Cook
    Ubuntu Security Team


    \
     
     \ /
      Last update: 2010-10-26 02:01    [W:0.024 / U:119.972 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site