linux-kernel - [PATCH] 4 bytes kernel memory disclosure in SO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <op.uo6zs6xiw20ydt@clem1.netasq.com>
Date:	Wed, 11 Feb 2009 15:56:56 +0100
From:	Clément LECIGNE <clement.lecigne@...asq.com>
To:	linux-kernel@...r.kernel.org
Subject: [PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt

Hello lkml,

In function sock_getsockopt() located in net/core/sock.c, optval v.val is  
not correctly initialized and directly returned in userland in case we  
have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
         unsigned char buf[4] = { 0, 0, 0, 0 };
         int len;
         int sock;
         sock = socket(33, 2, 2);
         getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
         printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
         close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its  
declaration.

Bests,

-- 
Clément LECIGNE,
:%s/coin/& coin/g
Download attachment "sock.bsdcompat.patch" of type "application/octet-stream" (332 bytes)