block: cciss: fix information leak to userland
Subsystems (2)
PATCH 1/1 block: cciss: fix information leak to userland
Structure IOCTL_Command_struct is copied to userland with some padding fields at the end of the struct unitialized. It leads to leaking of contents of kernel stack memory.
Signed-off-by Vasiliy Kulikov <[email protected]>
---
Compile tested.
drivers/block/cciss.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
drivers/block/cciss.c +1 -0
@@ -1184,6 +1184,7 @@ static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,int err;u32 cp; +memset (&arg64,0 ,sizeof (arg64)); err =0 ; err | copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
Signature · 1 line
1.7.0.4
Jens Axboe
AppliedQuoted 3 lines · Vasiliy Kulikov
Structure
IOCTL_Command_structis copied to userland with some padding fields at the end of the struct unitialized. It leads to leaking of contents of kernel stack memory.
Thanks, applied.
Signature · 1 line
Jens Axboe