Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752974AbZCNBT6 (ORCPT ); Fri, 13 Mar 2009 21:19:58 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751198AbZCNBTn (ORCPT ); Fri, 13 Mar 2009 21:19:43 -0400 Received: from kroah.org ([198.145.64.141]:34692 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751174AbZCNBTm (ORCPT ); Fri, 13 Mar 2009 21:19:42 -0400 X-Mailbox-Line: From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 Message-Id: <20090314011031.415433705@mini.kroah.org> User-Agent: quilt/0.48-1 Date: Fri, 13 Mar 2009 18:09:38 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Eugene Teo , "David S. Miller" Subject: [patch 001/114] net: amend the fix for SO_BSDCOMPAT gsopt infoleak References: <20090314010937.416083662@mini.kroah.org> Content-Disposition: inline; filename=net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch In-Reply-To: <20090314011649.GA26170@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1277 Lines: 31 2.6.28-stable review patch. If anyone has any objections, please let us know. ------------------ From: Eugene Teo [ Upstream commit 50fee1dec5d71b8a14c1b82f2f42e16adc227f8b ] The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note that the same problem of leaking kernel memory will reappear if someone on some architecture uses struct timeval with some internal padding (for example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to leak the padded bytes to userspace. Signed-off-by: Eugene Teo Reported-by: Mikulas Patocka Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/core/sock.c +++ b/net/core/sock.c @@ -696,7 +696,7 @@ int sock_getsockopt(struct socket *sock, if (len < 0) return -EINVAL; - v.val = 0; + memset(&v, 0, sizeof(v)); switch(optname) { case SO_DEBUG: -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/