lkml.org 
[lkml]   [2010]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] bluetooth: hidp: fix information leak to userland
    Date
    Structure hidp_conninfo is copied to userland with version, product,
    vendor and name fields unitialized if both session->input and session->hid
    are NULL. It leads to leaking of contents of kernel stack memory.

    Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
    ---
    Compile tested.

    net/bluetooth/hidp/core.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
    index c0ee8b3..29544c2 100644
    --- a/net/bluetooth/hidp/core.c
    +++ b/net/bluetooth/hidp/core.c
    @@ -107,6 +107,7 @@ static void __hidp_unlink_session(struct hidp_session *session)

    static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
    {
    + memset(ci, 0, sizeof(*ci));
    bacpy(&ci->bdaddr, &session->bdaddr);

    ci->flags = session->flags;
    @@ -115,7 +116,6 @@ static void __hidp_copy_session(struct hidp_session *session, struct hidp_connin
    ci->vendor = 0x0000;
    ci->product = 0x0000;
    ci->version = 0x0000;
    - memset(ci->name, 0, 128);

    if (session->input) {
    ci->vendor = session->input->id.vendor;
    --
    1.7.0.4


    \
     
     \ /
      Last update: 2010-10-30 16:29    [W:0.020 / U:30.964 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site