linux-kernel - [PATCHv2 7/7] char: n_gsm: improper skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1307144642-5915-8-git-send-email-russ.gorby@intel.com>
Date:	Fri,  3 Jun 2011 16:44:02 -0700
From:	Russ Gorby <russ.gorby@...el.com>
To:	Greg Kroah-Hartman <gregkh@...e.de>,
	Russ Gorby <russ.gorby@...el.com>, linux-kernel@...r.kernel.org
Cc:	suhail.ahmed@...el.com, russ.gorby@...el.com
Subject: [PATCHv2 7/7] char: n_gsm: improper skb_pull() use was leaking framed data

gsm_dlci_data_output_framed() was doing:
memcpy(dp, skb_pull(dlci->skb, len), len);

The problem is skb_pull() returns the post-increment skb->data ptr
so the first chunk can be leaked.

Signed-off-by: Russ Gorby <russ.gorby@...el.com>
---
 drivers/tty/n_gsm.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 7f95bfd..660c5ca 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -903,7 +903,8 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
 		*dp++ = last << 7 | first << 6 | 1;	/* EA */
 		len--;
 	}
-	memcpy(dp, skb_pull(dlci->skb, len), len);
+	memcpy(dp, dlci->skb->data, len);
+	skb_pull(dlci->skb, len);
 	__gsm_data_queue(dlci, msg);
 	if (last) {
 		kfree_skb(dlci->skb);
-- 
1.7.0.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/