Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1393849 > unrolled thread
| Started by | Kangjie Lu <kangjielu@gmail.com> |
|---|---|
| First post | 2016-05-04 00:10 +0200 |
| Last post | 2016-05-04 01:10 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] fix infoleak in ioctl_cfg80211 Kangjie Lu <kangjielu@gmail.com> - 2016-05-04 00:10 +0200
Re: [PATCH] fix infoleak in ioctl_cfg80211 Greg KH <gregkh@linuxfoundation.org> - 2016-05-04 01:10 +0200
| From | Kangjie Lu <kangjielu@gmail.com> |
|---|---|
| Date | 2016-05-04 00:10 +0200 |
| Subject | [PATCH] fix infoleak in ioctl_cfg80211 |
| Message-ID | <ruQFX-866-1@gated-at.bofh.it> |
"mac" is an array allocated in stack without being initialized, and will be sent out via "nla_put". The dump_station() is supposed to initialize the mac address; otherwise, sensitive data in kernel stack will be leaked. To fix this, either initialize it (e.g., memset) or completely remove this dump_station(). Signed-off-by: Kangjie Lu <kjlu@gatech.edu> --- drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c index 12d1844..44a1582 100644 --- a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c +++ b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c @@ -2926,6 +2926,7 @@ static int cfg80211_rtw_dump_station(struct wiphy *wiphy, /* TODO: dump scanned queue */ + memset(mac, 0, ETH_ALEN); return -ENOENT; } -- 1.9.1
[toc] | [next] | [standalone]
| From | Greg KH <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-05-04 01:10 +0200 |
| Message-ID | <ruRC1-C0-1@gated-at.bofh.it> |
| In reply to | #1393849 |
On Tue, May 03, 2016 at 06:11:46PM -0400, Kangjie Lu wrote: > "mac" is an array allocated in stack without being initialized, > and will be sent out via "nla_put". The dump_station() is supposed > to initialize the mac address; otherwise, sensitive data in kernel > stack will be leaked. To fix this, either initialize it (e.g., > memset) or completely remove this dump_station(). > > Signed-off-by: Kangjie Lu <kjlu@gatech.edu> > --- > drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c > index 12d1844..44a1582 100644 > --- a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c > +++ b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c > @@ -2926,6 +2926,7 @@ static int cfg80211_rtw_dump_station(struct wiphy *wiphy, > > /* TODO: dump scanned queue */ > > + memset(mac, 0, ETH_ALEN); > return -ENOENT; > } This isn't needed, as it returns -ENOENT and so mac never gets used. thanks, greg k-h
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web