mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2
In function sock_getsockopt() located in net/core/sock.c, optval v.val is not correctly initialized and directly returned in userland in case we have SO_BSDCOMPAT option set. This dummy code should trigger the bug: int main(void) { unsigned char buf[4] = { 0, 0, 0, 0 }; int len; int sock; sock = socket(33, 2, 2); getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len); printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]); close(sock); } Here is a patch that fix this bug by initalizing v.val just after its declaration. Signed-off-by: Clément Lecigne <clement.lecigne@netasq.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
354b45fff9
commit
df0bca049d
1 changed files with 2 additions and 0 deletions
|
@ -696,6 +696,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
|
|||
if (len < 0)
|
||||
return -EINVAL;
|
||||
|
||||
v.val = 0;
|
||||
|
||||
switch(optname) {
|
||||
case SO_DEBUG:
|
||||
v.val = sock_flag(sk, SOCK_DBG);
|
||||
|
|
Loading…
Reference in a new issue