lkml.org 
[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.14 02/32] batman-adv: Avoid probe ELP information leak
    Date
    From: Sven Eckelmann <sven@narfation.org>

    [ Upstream commit 88d0895d0ea9d4431507d576c963f2ff9918144d ]

    The probe ELPs for WiFi interfaces are expanded to contain at least
    BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
    number of bytes which the template ELP packet requires.

    These extra padding bytes were not initialized and thus could contain data
    which were previously stored at the same location. It is therefore required
    to set it to some predefined or random values to avoid leaking private
    information from the system transmitting these kind of packets.

    Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak")
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Acked-by: Antonio Quartulli <a@unstable.cc>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/batman-adv/bat_v_elp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
    index bd1064d98e16..bfc49d48eb57 100644
    --- a/net/batman-adv/bat_v_elp.c
    +++ b/net/batman-adv/bat_v_elp.c
    @@ -227,7 +227,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh)
    * the packet to be exactly of that size to make the link
    * throughput estimation effective.
    */
    - skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len);
    + skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len);

    batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
    "Sending unicast (probe) ELP packet on interface %s to %pM\n",
    --
    2.17.1
    \
     
     \ /
      Last update: 2018-10-08 17:34    [W:3.071 / U:0.412 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site