| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1289054477-18100-1-git-send-email-segooon@gmail.com> Date: Sat, 6 Nov 2010 17:41:16 +0300 From: Vasiliy Kulikov <segooon@...il.com> To: kernel-janitors@...r.kernel.org Cc: David Airlie <airlied@...ux.ie>, Dave Airlie <airlied@...hat.com>, Thomas Hellstrom <thellstrom@...are.com>, Jakob Bornecrantz <jakob@...are.com>, Dan Carpenter <error27@...il.com>, Jerome Glisse <jglisse@...hat.com>, dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org Subject: [PATCH] gpu: drm: vmwgfx: fix information leak to userland Structure drm_vmw_fence_rep is copied to userland with field "pad64" uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@...il.com> --- Compile tested. drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 51d9f9f..76954e3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -691,6 +691,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data, fence_rep.error = ret; fence_rep.fence_seq = (uint64_t) sequence; + fence_rep.pad64 = 0; user_fence_rep = (struct drm_vmw_fence_rep __user *) (unsigned long)arg->fence_rep; -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists