lkml.org 
[lkml]   [2010]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[18/44] usb: core: fix information leak to userland
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Vasiliy Kulikov <segooon@gmail.com>

    commit 886ccd4520064408ce5876cfe00554ce52ecf4a7 upstream.

    Structure usbdevfs_connectinfo is copied to userland with padding byted
    after "slow" field uninitialized. It leads to leaking of contents of
    kernel stack memory.

    Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/core/devio.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -883,10 +883,11 @@ static int proc_getdriver(struct dev_sta

    static int proc_connectinfo(struct dev_state *ps, void __user *arg)
    {
    - struct usbdevfs_connectinfo ci;
    + struct usbdevfs_connectinfo ci = {
    + .devnum = ps->dev->devnum,
    + .slow = ps->dev->speed == USB_SPEED_LOW
    + };

    - ci.devnum = ps->dev->devnum;
    - ci.slow = ps->dev->speed == USB_SPEED_LOW;
    if (copy_to_user(arg, &ci, sizeof(ci)))
    return -EFAULT;
    return 0;



    \
     
     \ /
      Last update: 2010-12-08 01:43    [W:0.021 / U:28.972 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site