Skip to contentSkip to conversation

block: cciss: fix information leak to userland

PATCH Applied Vasiliy Kulikov 2 participants 2 messages Oct 27, 2010 – Oct 28, 2010

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 block: cciss: fix information leak to userland

Structure IOCTL_Command_struct is copied to userland with some padding fields at the end of the struct unitialized. It leads to leaking of contents of kernel stack memory.

---
Compile tested.

 drivers/block/cciss.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
drivers/block/cciss.c +1 -0
index f09e6df..13d87a0 100644
@@ -1184,6 +1184,7 @@ static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
 	int err;
 	u32 cp;
 
+	memset(&arg64, 0, sizeof(arg64));
 	err = 0;
 	err | 	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
Signature · 1 line
1.7.0.4
Applied
#1 lore raw
Quoted 3 lines · Vasiliy Kulikov

Structure IOCTL_Command_struct is copied to userland with some padding fields at the end of the struct unitialized. It leads to leaking of contents of kernel stack memory.

Thanks, applied.

Signature · 1 line
Jens Axboe