lkml.org 
[lkml]   [2010]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] ipc: shm: fix information leak to userland
    From
    Date
    This one already got taken care of by Kees Cook:

    http://lkml.org/lkml/2010/10/6/486

    Thanks,
    Dan

    > Structure shmid_ds is copied to userland with shm_unused{,2,3}
    > fields unitialized. It leads to leaking of contents of kernel stack
    > memory.
    > Cc: stable@kernel.org
    > Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
    > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
    > ---
    > Compile tested.
    > ipc/shm.c | 1 +
    > 1 files changed, 1 insertions(+), 0 deletions(-)
    > diff --git a/ipc/shm.c b/ipc/shm.c
    > index fd658a1..7d3bb22 100644
    > --- a/ipc/shm.c
    > +++ b/ipc/shm.c
    > @@ -479,6 +479,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
    > {
    > struct shmid_ds out;
    >
    > + memset(&out, 0, sizeof(out));
    > ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
    > out.shm_segsz = in->shm_segsz;
    > out.shm_atime = in->shm_atime;




    \
     
     \ /
      Last update: 2010-10-30 17:05    [W:0.032 / U:32.808 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site