From patchwork Tue Feb 1 14:26:23 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 81312 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 8DD57B70F4 for ; Wed, 2 Feb 2011 01:26:42 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1PkHBl-0006M1-MD; Tue, 01 Feb 2011 14:26:37 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1PkHBh-0006Kh-29 for kernel-team@lists.ubuntu.com; Tue, 01 Feb 2011 14:26:33 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1PkHBg-00058r-Vb; Tue, 01 Feb 2011 14:26:32 +0000 Received: from [85.210.144.187] (helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1PkHBg-0000j2-Rd; Tue, 01 Feb 2011 14:26:32 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [dapper CVE 1/1] net: packet: fix information leak to userland Date: Tue, 1 Feb 2011 14:26:23 +0000 Message-Id: <1296570387-30250-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1296570387-30250-1-git-send-email-apw@canonical.com> References: <1296570387-30250-1-git-send-email-apw@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com packet_getname_spkt() doesn't initialize all members of sa_data field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sa_data with strncpy() instead of strlcpy(). The same with packet_getname(): it doesn't initialize sll_pkttype field of sockaddr_ll. Set it to zero. Signed-off-by: Vasiliy Kulikov Signed-off-by: David S. Miller CVE-2010-3876 BugLink: http://bugs.launchpad.net/bugs/710714 (backported from commit 67286640f638f5ad41a946b9a3dc75327950248f upstream) Signed-off-by: Andy Whitcroft --- net/packet/af_packet.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 3e24627..c8f0147 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1151,7 +1151,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, uaddr->sa_family = AF_PACKET; dev = dev_get_by_index(pkt_sk(sk)->ifindex); if (dev) { - strlcpy(uaddr->sa_data, dev->name, 15); + strncpy(uaddr->sa_data, dev->name, 14); dev_put(dev); } else memset(uaddr->sa_data, 0, 14); @@ -1175,6 +1175,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, sll->sll_family = AF_PACKET; sll->sll_ifindex = po->ifindex; sll->sll_protocol = po->num; + sll->sll_pkttype = 0; dev = dev_get_by_index(po->ifindex); if (dev) { sll->sll_hatype = dev->type;