Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966731Ab3DQTTz (ORCPT ); Wed, 17 Apr 2013 15:19:55 -0400 Received: from smtp.outflux.net ([198.145.64.163]:57741 "EHLO smtp.outflux.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966633Ab3DQTTs (ORCPT ); Wed, 17 Apr 2013 15:19:48 -0400 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Al Viro , Oleg Nesterov , Andrew Morton , "Eric W. Biederman" , Serge Hallyn , PaX Team , Kees Cook , Emese Revfy , stable@vger.kernel.org Subject: [PATCH] signal: stop info leak via the tkill and the tgkill syscalls Date: Wed, 17 Apr 2013 12:19:25 -0700 Message-Id: <1366226365-15594-1-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 1.7.9.5 X-HELO: www.outflux.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1325 Lines: 46 From: Emese Revfy This fixes a kernel memory contents leak via the tkill and tgkill syscalls for compat processes. This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field when handling signals delivered from tkill. The place of the infoleak: int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) { ... put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); ... } Signed-off-by: Emese Revfy Reviewed-by: PaX Team Signed-off-by: Kees Cook Cc: stable@vger.kernel.org --- kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/signal.c b/kernel/signal.c index dd72567..598dc06 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -2948,7 +2948,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info) static int do_tkill(pid_t tgid, pid_t pid, int sig) { - struct siginfo info; + struct siginfo info = {}; info.si_signo = sig; info.si_errno = 0; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/