diff options
author | Clément Lecigne <clement.lecigne@netasq.com> | 2009-02-13 00:59:09 (GMT) |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-02-13 00:59:09 (GMT) |
commit | df0bca049d01c0ee94afb7cd5dfd959541e6c8da (patch) | |
tree | 32df8eca11e248b8ae89d869a89bbd12a853f377 /net/core/sock.c | |
parent | 354b45fff90c3448c1eadabfad6ae7b8b8a2a237 (diff) | |
download | linux-fsl-qoriq-df0bca049d01c0ee94afb7cd5dfd959541e6c8da.tar.xz |
net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2
In function sock_getsockopt() located in net/core/sock.c, optval v.val
is not correctly initialized and directly returned in userland in case
we have SO_BSDCOMPAT option set.
This dummy code should trigger the bug:
int main(void)
{
unsigned char buf[4] = { 0, 0, 0, 0 };
int len;
int sock;
sock = socket(33, 2, 2);
getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
close(sock);
}
Here is a patch that fix this bug by initalizing v.val just after its
declaration.
Signed-off-by: Clément Lecigne <clement.lecigne@netasq.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/sock.c')
-rw-r--r-- | net/core/sock.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/sock.c b/net/core/sock.c index f3a0d08..6f2e133 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -696,6 +696,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname, if (len < 0) return -EINVAL; + v.val = 0; + switch(optname) { case SO_DEBUG: v.val = sock_flag(sk, SOCK_DBG); |