Skip to contentSkip to conversation

net: amend the fix for SO_BSDCOMPAT gsopt infoleak

PATCH Eugene Teo 2 participants 2 messages Feb 23, 2009

Subsystems (3)
Networking Network drivers Sockets
lore
Share & tools
lore

Eugene Teo

author
#0 lore raw

The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note that the same problem of leaking kernel memory will reappear if someone on some architecture uses struct timeval with some internal padding (for example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to leak the padded bytes to userspace.

Signed-off-by Eugene Teo <[email protected]>
Reported-by Mikulas Patocka <[email protected]>
net/core/sock.c +1 -1
index 6f2e133..913c95f 100644
@@ -696,7 +696,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 	if (len < 0)
 		return -EINVAL;
 
-	v.val = 0;
+	memset(&v, 0, sizeof(v));
 
 	switch(optname) {
 	case SO_DEBUG:
maintainer
#1 lore raw

From: Eugene Teo <[email protected]>
Date: Tue, 24 Feb 2009 00:41:12 +0800

Quoted 8 lines

The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note that the same problem of leaking kernel memory will reappear if someone on some architecture uses struct timeval with some internal padding (for example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to leak the padded bytes to userspace.

Signed-off-by Eugene Teo <[email protected]>
Reported-by Mikulas Patocka <[email protected]>

Applied and queued up for -stable, thanks Eugene.