lkml.org 
[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 124/260] drivers/net/eql.c: prevent reading uninitialized stack memory
    Date
    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit 44467187dc22fdd33a1a06ea0ba86ce20be3fe3c upstream.

    Fixed formatting (tabs and line breaks).

    The EQL_GETMASTRCFG device ioctl allows unprivileged users to read 16
    bytes of uninitialized stack memory, because the "master_name" member of
    the master_config_t struct declared on the stack in eql_g_master_cfg()
    is not altered or zeroed before being copied back to the user. This
    patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    drivers/net/eql.c | 2 ++
    1 files changed, 2 insertions(+), 0 deletions(-)

    diff --git a/drivers/net/eql.c b/drivers/net/eql.c
    index b34a2dd..a8b982d 100644
    --- a/drivers/net/eql.c
    +++ b/drivers/net/eql.c
    @@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_device *dev, master_config_t __user *mcp)
    equalizer_t *eql;
    master_config_t mc;

    + memset(&mc, 0, sizeof(master_config_t));
    +
    if (eql_is_master(dev)) {
    eql = netdev_priv(dev);
    mc.max_slaves = eql->max_slaves;
    --
    1.7.3.3


    \
     
     \ /
      Last update: 2011-01-02 08:55    [W:0.025 / U:59.636 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site