From patchwork Thu Jun 20 11:31:29 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 252882 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id C2B492C02AC for ; Thu, 20 Jun 2013 21:31:50 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1Upd5W-0006DT-5D; Thu, 20 Jun 2013 11:31:38 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1Upd5O-0006Cz-Bv for kernel-team@lists.ubuntu.com; Thu, 20 Jun 2013 11:31:30 +0000 Received: from bl22-240-238.dsl.telepac.pt ([2.83.240.238] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Upd5O-0001Y2-67 for kernel-team@lists.ubuntu.com; Thu, 20 Jun 2013 11:31:30 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [Lucid][CVE-2013-2141] kernel/signal.c: stop info leak via the tkill and the tgkill syscalls Date: Thu, 20 Jun 2013 12:31:29 +0100 Message-Id: <1371727889-8720-1-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Emese Revfy BugLink: https://bugs.launchpad.net/bugs/1187732 CVE-2013-2141 This fixes a kernel memory contents leak via the tkill and tgkill syscalls for compat processes. This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field when handling signals delivered from tkill. The place of the infoleak: int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) { ... put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); ... } Signed-off-by: Emese Revfy Reviewed-by: PaX Team Signed-off-by: Kees Cook Cc: Al Viro Cc: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Serge Hallyn Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds (cherry picked from commit b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f) Signed-off-by: Luis Henriques Acked-by: Andy Whitcroft --- kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/signal.c b/kernel/signal.c index 1c6675b..fb7e242 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -2301,7 +2301,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info) static int do_tkill(pid_t tgid, pid_t pid, int sig) { - struct siginfo info; + struct siginfo info = {}; info.si_signo = sig; info.si_errno = 0;