Skip to contentSkip to conversation

8 bytes kernel memory disclosure in AppleTalk getsockname.

PATCH In review Clement LECIGNE 3 participants 5 messages Aug 26, 2009

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Clement LECIGNE

author
#0 lore raw

PATCH 1/1 8 bytes kernel memory disclosure in AppleTalk getsockname.

Hi,

In function atalk_getname(), sockaddr_at is returned in userland without zero'ing the "char sat_zero[8]" field. This bug allows user to display 8 bytes leaked from the kernel stack.

Here is a patch that zero the whole sockaddr_at structure before processing it. It should fix this bug.

Signed-off-by Clément Lecigne <[email protected]>
net/appletalk/ddp.c +2 -0
@@ -1241,6 +1241,8 @@ static int atalk_getname(struct socket *
 		if (atalk_autobind(sk) < 0)
 			return -ENOBUFS;
 
+	memset(&sat, 0, sizeof(struct sockaddr_at));
+
 	*uaddr_len = sizeof(struct sockaddr_at);
 
 	if (peer) {
Signature · 3 lines
Clément LECIGNE,
-Only one remote hole in the default install, in more than 10 years!<br>
+Only two remote holes in the default install, in more than 10 years!<br>
#1 lore raw
Quoted 2 lines · Clement LECIGNE

Here is a patch that zero the whole sockaddr_at structure before processing it. It should fix this bug.

Same kind of bug at http://lkml.org/lkml/2006/7/25/51 . I wonder why not zero'ing sockaddr at the caller rather than zero'ing at individual ->getname(). Doing so will save some lines.

#2 lore raw
Quoted 8 lines · Tetsuo Handa
Quoted 2 lines · Clement LECIGNE

Here is a patch that zero the whole sockaddr_at structure before processing it. It should fix this bug.

Same kind of bug at http://lkml.org/lkml/2006/7/25/51 . I wonder why not zero'ing sockaddr at the caller rather than zero'ing at individual ->getname(). Doing so will save some lines. --

It would not help zeroing buffer before calling ->getname(), since getname() will overwrite it with a memcpy(buffer, &somestruct, sizeof(somestruct));

#3 lore raw
In reply to Clement LECIGNE
Quoted 14 lines · Clement LECIGNE

Hi,

In function atalk_getname(), sockaddr_at is returned in userland without zero'ing the "char sat_zero[8]" field. This bug allows user to display 8 bytes leaked from the kernel stack.

Here is a patch that zero the whole sockaddr_at structure before processing it. It should fix this bug.

Signed-off-by Clément Lecigne <[email protected]>

net/appletalk/ddp.c static int atalk_getname(struct socket * · line 1248

Quoted 8 lines
net/appletalk/ddp.c +2 -0
@@ -1241,6 +1241,8 @@ static int atalk_getname(struct socket *
 		if (atalk_autobind(sk) < 0)
 			return -ENOBUFS;
 
+	memset(&sat, 0, sizeof(struct sockaddr_at));
+
 	*uaddr_len = sizeof(struct sockaddr_at);
 
 	if (peer) {

Hi Clement

Well, I submitted same patch some weeks ago and I just checked that it was already in Linus tree.

author Eric Dumazet <[email protected]>

	Thu, 6 Aug 2009 02:27:43 +0000 (02:27 +0000)
committer	David S. Miller <[email protected]>
	Thu, 6 Aug 2009 20:08:45 +0000 (13:08 -0700)

commit 3d392475c873c10c10d6d96b94d092a34ebd4791

appletalk: fix atalk_getname() leak

atalk_getname() can leak 8 bytes of kernel memory to user

Signed-off-by Eric Dumazet <[email protected]>
Signed-off-by David S. Miller <[email protected]>

Dont worry, it'll be included in upcoming 2.6.31 kernel, and backported to previous ones as well.

author
#4 lore raw
Quoted 36 lines · Eric Dumazet
Quoted 14 lines · Clement LECIGNE

Hi,

In function atalk_getname(), sockaddr_at is returned in userland without zero'ing the "char sat_zero[8]" field. This bug allows user to display 8 bytes leaked from the kernel stack.

Here is a patch that zero the whole sockaddr_at structure before processing it. It should fix this bug.

Signed-off-by Clément Lecigne <[email protected]>

net/appletalk/ddp.c static int atalk_getname(struct socket * · line 1248

Quoted 8 lines
net/appletalk/ddp.c +2 -0
@@ -1241,6 +1241,8 @@ static int atalk_getname(struct socket *
 		if (atalk_autobind(sk) < 0)
 			return -ENOBUFS;
 
+	memset(&sat, 0, sizeof(struct sockaddr_at));
+
 	*uaddr_len = sizeof(struct sockaddr_at);
 
 	if (peer) {

Hi Clement

Well, I submitted same patch some weeks ago and I just checked that it was already in Linus tree.

author Eric Dumazet <[email protected]>

	Thu, 6 Aug 2009 02:27:43 +0000 (02:27 +0000)
committer	David S. Miller <[email protected]>
	Thu, 6 Aug 2009 20:08:45 +0000 (13:08 -0700)

commit 3d392475c873c10c10d6d96b94d092a34ebd4791

appletalk: fix atalk_getname() leak

Quoted 8 lines

atalk_getname() can leak 8 bytes of kernel memory to user

Signed-off-by Eric Dumazet <[email protected]>
Signed-off-by David S. Miller <[email protected]>

Dont worry, it'll be included in upcoming 2.6.31 kernel, and backported to previous ones as well.

Hi Eric,

Oups, shame on me, I have not checked Linus tree before submitting the patch.

Sorry,

Signature · 3 lines
Clément LECIGNE,
-Only one remote hole in the default install, in more than 10 years!<br>
+Only two remote holes in the default install, in more than 10 years!<br>