linux-kernel - Re: [stable] [Stable-review] [18/74] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110414182737.GB12732@kroah.com>
Date:	Thu, 14 Apr 2011 11:27:37 -0700
From:	Greg KH <greg@...ah.com>
To:	Ben Hutchings <ben@...adent.org.uk>
Cc:	Greg KH <gregkh@...e.de>, Dan Rosenberg <drosenberg@...curity.com>,
	linux-kernel@...r.kernel.org, stable-review@...nel.org,
	Alex Elder <aelder@....com>, akpm@...ux-foundation.org,
	torvalds@...ux-foundation.org, stable@...nel.org,
	alan@...rguk.ukuu.org.uk
Subject: Re: [stable] [Stable-review] [18/74] xfs: prevent leaking
 uninitialized stack memory in FSGEOMETRY_V1

On Thu, Apr 14, 2011 at 03:54:45AM +0100, Ben Hutchings wrote:
> On Wed, 2011-04-13 at 08:50 -0700, Greg KH wrote:
> > 2.6.32-longterm review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > From: Dan Rosenberg <drosenberg@...curity.com>
> > 
> > commit c4d0c3b097f7584772316ee4d64a09fe0e4ddfca upstream.
> > 
> > The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
> > xfs_fs_geometry() with a version number of 3.  This code path does not
> > fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
> > the leaking of four bytes of uninitialized stack data to potentially
> > unprivileged callers.
> [...]
> 
> This caused a serious regression and requires a second fix:
> 
> commit af24ee9ea8d532e16883251a6684dfa1be8eec29
> Author: Alex Elder <aelder@....com>
> Date:   Tue Mar 1 17:50:00 2011 +0000
> 
>     xfs: zero proper structure size for geometry calls

Thanks for letting me know, I've queued up this patch as well.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/