netdev - Re: [PATCH] CAN: Use inode instead of kernel address for /proc file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 25 Dec 2010 23:31:40 +0100
From:	Oliver Hartkopp <socketcan@...tkopp.net>
To:	Dan Rosenberg <drosenberg@...curity.com>
CC:	Urs Thuermann <urs.thuermann@...kswagen.de>,
	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	security@...nel.org
Subject: Re: [PATCH] CAN: Use inode instead of kernel address for /proc file

On 25.12.2010 23:22, Oliver Hartkopp wrote:
> On 25.12.2010 23:16, Dan Rosenberg wrote:
>> Since the socket address is just being used as a unique identifier, its
>> inode number is an alternative that does not leak potentially sensitive
>> information.
>>
>> CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue.
>>
>> Signed-off-by: Dan Rosenberg <drosenberg@...curity.com>
>> Cc: stable <stable@...nel.org>
> 
> Acked-by: Oliver Hartkopp <socketcan@...tkopp.net>
> 
> Thanks Dan.
> 
>> ---
>>  net/can/bcm.c |    4 ++--
>>  1 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/can/bcm.c b/net/can/bcm.c
>> index 6faa825..5748901 100644
>> --- a/net/can/bcm.c
>> +++ b/net/can/bcm.c
>> @@ -1520,8 +1520,8 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
>>  	bo->bound = 1;
>>  
>>  	if (proc_dir) {
>> -		/* unique socket address as filename */
>> -		sprintf(bo->procname, "%p", sock);
>> +		/* socket inode as filename */
>> +		sprintf(bo->procname, "%lx", sock_i_ino(sk));

One minor question:

AFAIK the inode numbers that can be found in /proc/<pid>/fd/* are in decimal
and not in hex, right?

If so, you should use '%lu' instead of '%lx' in the patch.

Regards,
Oliver
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html