Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1393850 > unrolled thread

[PATCH] fix infoleak in wilc_wfi_cfgoperations

Back to article view | Back to linux.kernel

Contents

  [PATCH] fix infoleak in wilc_wfi_cfgoperations Kangjie Lu <kangjielu@gmail.com> - 2016-05-04 00:20 +0200
    Re: [PATCH] fix infoleak in wilc_wfi_cfgoperations Greg KH <gregkh@linuxfoundation.org> - 2016-05-04 01:10 +0200

#1393850 — [PATCH] fix infoleak in wilc_wfi_cfgoperations

"mac" is an array allocated in stack without being initialized,
and will be sent out via "nla_put". The dump_station() is supposed
to initialize the mac address; otherwise, sensitive data in kernel
stack will be leaked. To fix this, initialize it with memset or
fill it with meaningful mac address.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
---
 drivers/staging/wilc1000/wilc_wfi_cfgoperations.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 448a5c8..44c1356 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1797,6 +1797,7 @@ static int dump_station(struct wiphy *wiphy, struct net_device *dev,
 
 	wilc_get_rssi(vif, &sinfo->signal);
 
+	memset(mac, 0, ETH_ALEN);
 	return 0;
 }
 
-- 
1.9.1

[toc] | [next] | [standalone]

#1393857

On Tue, May 03, 2016 at 06:17:28PM -0400, Kangjie Lu wrote:
> "mac" is an array allocated in stack without being initialized,
> and will be sent out via "nla_put". The dump_station() is supposed
> to initialize the mac address; otherwise, sensitive data in kernel
> stack will be leaked. To fix this, initialize it with memset or
> fill it with meaningful mac address.

"or"?  You just set it to zero, why not fix this correctly and put the
real address here?

thanks,

greg k-h

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web