linux-kernel - [PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1285427247.7957.35.camel@Dan>
Date:	Sat, 25 Sep 2010 11:07:27 -0400
From:	Dan Rosenberg <drosenberg@...curity.com>
To:	perex@...ex.cz, tiwai@...e.de
Cc:	alsa-devel@...a-project.org, linux-kernel@...r.kernel.org,
	security@...nel.org, stable@...nel.org
Subject: [PATCH] sound/pci/rme9652: prevent reading uninitialized stack
 memory

The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@...il.com>

diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c
--- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c	2010-09-20 16:59:09.000000000 -0400
+++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c	2010-09-25 10:59:42.000000000 -0400
@@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s
 		unsigned long flags;
 		int i;
 
+		memset(&info, 0, sizeof(info));
+
 		err = hdsp_check_for_iobox(hdsp);
 		if (err < 0)
 			return err;
diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c
--- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c	2010-09-20 16:59:09.000000000 -0400
+++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c	2010-09-25 10:58:44.000000000 -0400
@@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct 
 	case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
 
 		spin_lock_irq(&hdspm->lock);
+		
+		memset(&info, 0, sizeof(info));
+		
 		info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
 		info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/