linux-kernel - Re: [PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 25 Sep 2010 17:52:35 +0200
From:	Takashi Iwai <tiwai@...e.de>
To:	Dan Rosenberg <drosenberg@...curity.com>
Cc:	perex@...ex.cz, alsa-devel@...a-project.org,
	linux-kernel@...r.kernel.org, security@...nel.org,
	stable@...nel.org
Subject: Re: [PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory

At Sat, 25 Sep 2010 11:07:27 -0400,
Dan Rosenberg wrote:
> 
> The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
> SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
> unprivileged users to read uninitialized kernel stack memory, because
> several fields of the hdsp{m}_config_info structs declared on the stack
> are not altered or zeroed before being copied back to the user.  This
> patch takes care of it.
> 
> Signed-off-by: Dan Rosenberg <dan.j.rosenberg@...il.com>

Thanks, applied now with minor optimization (memset outside
spinlock).


Takashi


> diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c
> --- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c	2010-09-20 16:59:09.000000000 -0400
> +++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c	2010-09-25 10:59:42.000000000 -0400
> @@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s
>  		unsigned long flags;
>  		int i;
>  
> +		memset(&info, 0, sizeof(info));
> +
>  		err = hdsp_check_for_iobox(hdsp);
>  		if (err < 0)
>  			return err;
> diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c
> --- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c	2010-09-20 16:59:09.000000000 -0400
> +++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c	2010-09-25 10:58:44.000000000 -0400
> @@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct 
>  	case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
>  
>  		spin_lock_irq(&hdspm->lock);
> +		
> +		memset(&info, 0, sizeof(info));
> +		
>  		info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
>  		info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);
>  
> 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/