2010-10-30 14:26:26

by Kulikov Vasiliy

Subject: [PATCH] bluetooth: cmtp: fix information leak to userland

Structure cmtp_conninfo is copied to userland with some padding fields
unitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <[email protected]>
---
Compile tested.

net/bluetooth/cmtp/core.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index ec0a134..8e5f292 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -78,6 +78,7 @@ static void __cmtp_unlink_session(struct cmtp_session *session)

static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
{
+ memset(ci, 0, sizeof(*ci));
bacpy(&ci->bdaddr, &session->bdaddr);

ci->flags = session->flags;
--
1.7.0.4

2010-11-03 18:36:30

by Gustavo Padovan

Subject: Re: [PATCH] bluetooth: cmtp: fix information leak to userland

* Marcel Holtmann <[email protected]> [2010-11-02 16:35:58 +0100]:

> Hi Vasiliy,
>
> > Structure cmtp_conninfo is copied to userland with some padding fields
> > unitialized. It leads to leaking of contents of kernel stack memory.
> >
> > Signed-off-by: Vasiliy Kulikov <[email protected]>
>
> Acked-by: Marcel Holtmann <[email protected]>

Applied, thanks.

--
Gustavo F. Padovan
ProFUSION embedded systems - http://profusion.mobi

2010-11-02 15:35:58

by Marcel Holtmann

Subject: Re: [PATCH] bluetooth: cmtp: fix information leak to userland

Hi Vasiliy,

> Structure cmtp_conninfo is copied to userland with some padding fields
> unitialized. It leads to leaking of contents of kernel stack memory.
>
> Signed-off-by: Vasiliy Kulikov <[email protected]>

Acked-by: Marcel Holtmann <[email protected]>

Regards

Marcel