Fix SO_ORIGINAL_DST information leak (CVE-2006-1343)

Hi,

the fix for CVE-2006-1343 (information leak) never made it upstream:

http://marc.theaimsgroup.com/?l=linux-netdev&m=114148078223594&w=2

So here it is again against the latest git repository and with the additional line in net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c.

Regards

Marcel

[PATCH] Fix small information leak in SO_ORIGINAL_DST

It appears that sockaddr_in.sin_zero is not zeroed during getsockopt(...SO_ORIGINAL_DST...) operation. This can lead to an information leak (CVE-2006-1343).

---
commit 8b9b62a6bb6c5488fd094d97216787e191721a15
tree fac8f79c318f37d4cb6795e540b77be61c9d1f5d
parent 705af309505681f197f81618440954d10f120dc0
author Marcel Holtmann <[email protected]> Fri, 26 May 2006 13:45:42 +0200 committer Marcel Holtmann <[email protected]> Fri, 26 May 2006 13:45:42 +0200

 net/ipv4/netfilter/ip_conntrack_core.c         |    1 +
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |    1 +
 2 files changed, 2 insertions(+), 0 deletions(-)

index 979a2ea..a297da7 100644
@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, 
 			.tuple.dst.u.tcp.port;
 		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
 			.tuple.dst.ip;
+		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
 		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
 		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));

index 5bc9f64..77d9744 100644
@@ -348,6 +348,7 @@ getorigdst(struct sock *sk, int optval, 
 			.tuple.dst.u.tcp.port;
 		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
 			.tuple.dst.u3.ip;
+		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
 		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
 		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));

Applied, thanks Marcel. I think I missed this one because I saw it appear in 2.4, so I concluded that Dave already applied it. Looking at the Changelog it was Marcelo himself.