2007-08-27 14:13:14

by Luciano Rocha

[permalink] [raw]
Subject: data disclosure in ioctl sg inquiry


(Please keep me CC'ed. Thanks.)

Hello,

While testing the SG INQUIRY command to a locked hard drive, connected
with USB, I noted that the command result included garbage that seemed
part of some other's process memory. Like bash functions, command
arguments, etc..

I make sure to memset the buffers before running the ioctl, so this seem
to be data leaked from the kernel.

Most of the code is verbatim from the example in the SCSI Generic HOWTO
(<http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html>).

I include the code I used and sample output with data from running
processes (or files?).

I can't reproduce this on a firewire connected HDD, but I can with
another USB connecte one (not locked).

Regards,
Luciano Rocha

--
lfr
0/0


Attachments:
(No filename) (0.00 B)
(No filename) (189.00 B)
Download all attachments