Messages in this thread | | | Date | Thu, 08 Jun 2017 16:04:25 -0400 (EDT) | Subject | Re: [PATCH] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers | From | David Miller <> |
| |
From: Mateusz Jurczyk <mjurczyk@google.com> Date: Thu, 8 Jun 2017 11:13:36 +0200
> Verify that the caller-provided sockaddr structure is large enough to > contain the sa_family field, before accessing it in bind() and connect() > handlers of the AF_UNIX socket. Since neither syscall enforces a minimum > size of the corresponding memory region, very short sockaddrs (zero or > one byte long) result in operating on uninitialized memory while > referencing .sa_family. > > Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
The sockaddr comes from a structure on the caller's kernel stack, even if the user gives a smaller length, it is legal to access that memory.
| |