lkml.org 
[lkml]   [2017]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectLinux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak


Sometimes irda_getsockopt() doesn't initialize all members of list field of irda_device_list struct.  This structure is then copied to
userland.  It leads to leaking of contents of kernel stack memory.  

2  net/irda/af_irda.c
@@ -2248,6 +2248,8 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
  err = -EINVAL;
  goto out;
  }
+
+ memset( &list, 0, sizeof(struct irda_device_list) );
 
  /* Ask lmp for the current discovery log */
  discoveries = irlmp_get_discoveries(&list.len, self->mask.word,


 
\
 
 \ /
  Last update: 2017-08-03 16:03    [W:0.036 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site