Messages in this thread | | | Date | Tue, 9 Nov 2010 22:43:07 +0200 | Subject | Re: [PATCH] ipc: explicitly clear stack memory in user structs | From | Pekka Enberg <> |
| |
On Tue, Oct 26, 2010 at 2:58 AM, Kees Cook <kees.cook@canonical.com> wrote: > CVE-2010-4072 > > The old shm interface will leak a few bytes of stack contents. Explicitly > clear structure using memset instead of C99-style initialization in case > there are ever holes in the packing. > > Cc: stable <stable@kernel.org> > Signed-off-by: Kees Cook <kees.cook@canonical.com>
This looks like a genuine bug fix but I don't see this patch in mainline. Why is that?
> --- > > This was originally sent as http://lkml.org/lkml/2010/10/6/486 but was > never taken into any tree. > > --- > ipc/shm.c | 2 ++ > 1 files changed, 2 insertions(+), 0 deletions(-) > > diff --git a/ipc/shm.c b/ipc/shm.c > index 52ed77e..f943b1e 100644 > --- a/ipc/shm.c > +++ b/ipc/shm.c > @@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ > { > struct shmid_ds out; > > + memset(&out, 0, sizeof(out)); > ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm); > out.shm_segsz = in->shm_segsz; > out.shm_atime = in->shm_atime; > @@ -524,6 +525,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf > { > struct shminfo out; > > + memset(&out, 0, sizeof(out)); > if(in->shmmax > INT_MAX) > out.shmmax = INT_MAX; > else > -- > 1.7.1 > > -- > Kees Cook > Ubuntu Security Team > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |