lkml.org 
[lkml]   [2011]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[036/107] TPM: Zero buffer after copying to userspace
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Peter Huewe <huewe.external.infineon@googlemail.com>

    commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.

    Since the buffer might contain security related data it might be a good idea to
    zero the buffer after we have copied it to userspace.

    This got assigned CVE-2011-1162.

    Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
    Signed-off-by: James Morris <jmorris@namei.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/char/tpm/tpm.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- a/drivers/char/tpm/tpm.c
    +++ b/drivers/char/tpm/tpm.c
    @@ -1044,6 +1044,7 @@ ssize_t tpm_read(struct file *file, char
    {
    struct tpm_chip *chip = file->private_data;
    ssize_t ret_size;
    + int rc;

    del_singleshot_timer_sync(&chip->user_read_timer);
    flush_scheduled_work();
    @@ -1054,8 +1055,11 @@ ssize_t tpm_read(struct file *file, char
    ret_size = size;

    mutex_lock(&chip->buffer_mutex);
    - if (copy_to_user(buf, chip->data_buffer, ret_size))
    + rc = copy_to_user(buf, chip->data_buffer, ret_size);
    + memset(chip->data_buffer, 0, ret_size);
    + if (rc)
    ret_size = -EFAULT;
    +
    mutex_unlock(&chip->buffer_mutex);
    }




    \
     
     \ /
      Last update: 2011-11-03 03:11    [W:0.019 / U:29.816 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site