ipmi: info leak in compat_ipmi_ioctl()
Subsystems (2)
PATCH v2 1/1 ipmi: info leak in compat_ipmi_ioctl()
On x86_64 there is a 4 byte hole between ->recv_type and ->addr.
Signed-off-by Dan Carpenter <[email protected]>
---
v2: fixed the changelog a little. Also added LKML because the openipmi is a moderated list (and the moderator thought my email was spam).
drivers/char/ipmi/ipmi_devintf.c +1 -0
@@ -810,6 +810,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,struct ipmi_recv __user *precv64;struct ipmi_recv recv64; +memset (&recv64,0 ,sizeof (recv64));if (get_compat_ipmi_recv (&recv64,compat_ptr (arg)))return -EFAULT ;
Quoted 1 line · Dan Carpenter
On
x86_64there is a 4 byte hole between ->recv_type and ->addr.
Got it, in my tree now. Thanks.
Quoted 6 lines
Signed-off-by Dan Carpenter <[email protected]>---
v2: fixed the changelog a little. Also added LKML because the openipmi is a moderated list (and the moderator thought my email was spam).
I apologize, the list gets a lot of spam, and I must have made a mistake.
-corey
Quoted 13 lines
drivers/char/ipmi/ipmi_devintf.c +1
-0@@ -810,6 +810,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,struct ipmi_recv __user *precv64;struct ipmi_recv recv64; +memset (&recv64,0 ,sizeof (recv64));if (get_compat_ipmi_recv (&recv64,compat_ptr (arg)))return -EFAULT ;