Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1402018

[PATCH 3.14 16/17] net: fix a kernel infoleak in x25 module

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kangjie Lu <kangjielu@gmail.com>

[ Upstream commit 79e48650320e6fba48369fccf13fd045315b19b8 ]

Stack object "dte_facilities" is allocated in x25_rx_call_request(),
which is supposed to be initialized in x25_negotiate_facilities.
However, 5 fields (8 bytes in total) are not initialized. This
object is then copied to userland via copy_to_user, thus infoleak
occurs.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/x25_facilities.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_b
 
 	memset(&theirs, 0, sizeof(theirs));
 	memcpy(new, ours, sizeof(*new));
+	memset(dte, 0, sizeof(*dte));
 
 	len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
 	if (len < 0)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 03:20 +0200
  [PATCH 3.14 05/17] drm/radeon: fix PLL sharing on DCE6.1 (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 03:20 +0200
  [PATCH 3.14 08/17] decnet: Do not build routes to devices without decnet private data. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 03:20 +0200
  [PATCH 3.14 14/17] VSOCK: do not disconnect socket when peer has shutdown SEND only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 03:20 +0200
  [PATCH 3.14 16/17] net: fix a kernel infoleak in x25 module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 03/17] Input: max8997-haptic - fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 09/17] route: do not cache fib route info on local routes with oif Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 01/17] crypto: hash - Fix page length clamping in hash walk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 04/17] asmlinkage, pnp: Make variables used from assembler code visible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 15/17] net: bridge: fix old ioctl unlocked net device walk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 17/17] arm64: Make arch_randomize_brk avoid stack area Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
    Re: [PATCH 3.14 17/17] arm64: Make arch_randomize_brk avoid stack  area "Jon Medhurst (Tixy)" <tixy@linaro.org> - 2016-05-17 12:00 +0200
      Re: [PATCH 3.14 17/17] arm64: Make arch_randomize_brk avoid stack  area Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 22:40 +0200
  [PATCH 3.14 02/17] get_rock_ridge_filename(): handle malformed NM entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  [PATCH 3.14 11/17] atl2: Disable unimplemented scatter/gather feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 04:10 +0200
  Re: [PATCH 3.14 00/17] 3.14.70-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-17 06:10 +0200
    Re: [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 22:40 +0200
  Re: [PATCH 3.14 00/17] 3.14.70-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-17 19:30 +0200
    Re: [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 22:40 +0200
  Re: [PATCH 3.14 00/17] 3.14.70-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-05-17 19:30 +0200
    Re: [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-17 22:40 +0200
  Re: [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-19 06:00 +0200

csiph-web