From patchwork Sun May 8 19:57:25 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Filip Palian X-Patchwork-Id: 94603 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2CF73B7161 for ; Mon, 9 May 2011 05:57:36 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751313Ab1EHT52 (ORCPT ); Sun, 8 May 2011 15:57:28 -0400 Received: from mail-yi0-f46.google.com ([209.85.218.46]:46971 "EHLO mail-yi0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750814Ab1EHT50 (ORCPT ); Sun, 8 May 2011 15:57:26 -0400 Received: by yia27 with SMTP id 27so1623380yia.19 for ; Sun, 08 May 2011 12:57:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pjwstk.edu.pl; s=google; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=XITfCLw3DzR+HLMXMU6Q+XeSS72Vw/2MeyCU/Qoonf8=; b=ZFGfRvNlB47sXOOYBiCuQMEbbp/pbQMK3hx3rIXHD3DJYpfGtR6ptihJ8mPo3LJ6+R KZ31eLKKNUebx8yexlG5EsP2YhkZ/UlgiM/i1tgLV7PEE7JFYsM7W6jKwisvj+L1kEyx 2xpgv3p7u6Y4FX8HhiSh6NB2EmG/TUysTGQNc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=pjwstk.edu.pl; s=google; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=BtpIdZ0T+w3CC3qhzeIz+1HzG7zjNKmBguYkLY6uTS3vIZU4zDetX1hop/WpM/dRZg LtSOfgOVG01gf3Fsz3jGyB9pstVh4Oyd0Ar0dYZmSSQVW1xvelMraNAjf7zejviEXlX1 ulCKZVKBRQ+vNFDP9dw2ZOgBhtYMR6vuwaC5M= MIME-Version: 1.0 Received: by 10.151.135.21 with SMTP id m21mr5008405ybn.373.1304884645391; Sun, 08 May 2011 12:57:25 -0700 (PDT) Received: by 10.150.57.19 with HTTP; Sun, 8 May 2011 12:57:25 -0700 (PDT) Date: Sun, 8 May 2011 21:57:25 +0200 Message-ID: Subject: Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace. From: Filip Palian To: Marcel Holtmann , "Gustavo F. Padovan" , "David S. Miller" , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: security@kernel.org, oss-security@lists.openwall.com Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, Structures "l2cap_conninfo" and "rfcomm_conninfo" have one padding byte each. This byte in "cinfo" is copied to userspace uninitialized. patch no.1: -- cut -- -- cut -- Found by Marek Kroemeke and Filip Palian. Special thanks to Vasiliy Kulikov for verifying this bug. Best regards. --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/net/bluetooth/l2cap_sock.c 2011-05-04 03:59:13.000000000 +0100 +++ b/net/bluetooth/l2cap_sock.c 2011-05-08 18:57:20.000000000 +0100 @@ -446,6 +446,7 @@ static int l2cap_sock_getsockopt_old(str break; } + memset(&cinfo, 0, sizeof(cinfo)); cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle; memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3); -- cut -- patch no.2: -- cut -- --- a/net/bluetooth/rfcomm/sock.c 2011-05-04 03:59:13.000000000 +0100 +++ b/net/bluetooth/rfcomm/sock.c 2011-05-08 19:00:24.000000000 +0100 @@ -787,6 +787,7 @@ static int rfcomm_sock_getsockopt_old(st l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; + memset(&cinfo, 0, sizeof(cinfo)); cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle; memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);