From patchwork Tue Mar 26 17:14:47 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 231484 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id A50DE2C00C8 for ; Wed, 27 Mar 2013 04:14:59 +1100 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UKXSV-0007j6-Jn; Tue, 26 Mar 2013 17:14:51 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UKXST-0007hd-TH for kernel-team@lists.ubuntu.com; Tue, 26 Mar 2013 17:14:49 +0000 Received: from bl20-143-66.dsl.telepac.pt ([2.81.143.66] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1UKXST-0001IE-MA for kernel-team@lists.ubuntu.com; Tue, 26 Mar 2013 17:14:49 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [Lucid CVE-2012-6544 1/2] Bluetooth: L2CAP - Fix info leak via getsockname() Date: Tue, 26 Mar 2013 17:14:47 +0000 Message-Id: <1364318088-16737-1-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Mathias Krause CVE-2012-6544 BugLink: http://bugs.launchpad.net/bugs/1156751 The L2CAP code fails to initialize the l2_bdaddr_type member of struct sockaddr_l2 and the padding byte added for alignment. It that for leaks two bytes kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause Cc: Marcel Holtmann Cc: Gustavo Padovan Cc: Johan Hedberg Signed-off-by: David S. Miller (back ported from commit 792039c73cf176c8e39a6e8beef2c94ff46522ed) Signed-off-by: Luis Henriques Conflicts: net/bluetooth/l2cap_sock.c --- net/bluetooth/l2cap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 71120ee..1c20bd9 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -1184,6 +1184,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l BT_DBG("sock %p, sk %p", sock, sk); + memset(la, 0, sizeof(struct sockaddr_l2)); addr->sa_family = AF_BLUETOOTH; *len = sizeof(struct sockaddr_l2);