lkml.org 
[lkml]   [2013]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch] fanotify: info leak in copy_event_to_user()
    The ->reserverd field isn't cleared so we leak one byte of stack
    information to userspace.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

    diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
    index 6c80083..77cc85d 100644
    --- a/fs/notify/fanotify/fanotify_user.c
    +++ b/fs/notify/fanotify/fanotify_user.c
    @@ -122,6 +122,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
    metadata->event_len = FAN_EVENT_METADATA_LEN;
    metadata->metadata_len = FAN_EVENT_METADATA_LEN;
    metadata->vers = FANOTIFY_METADATA_VERSION;
    + metadata->reserved = 0;
    metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
    metadata->pid = pid_vnr(event->tgid);
    if (unlikely(event->mask & FAN_Q_OVERFLOW))

    \
     
     \ /
      Last update: 2013-06-03 12:02    [W:0.024 / U:1.352 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site