linux-kernel - Re: [PATCH] fix a kernel infoleak in x25 module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20160509.224702.1025080380497378551.davem@davemloft.net>
Date:	Mon, 09 May 2016 22:47:02 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	kangjielu@...il.com
Cc:	andrew.hendry@...il.com, linux-x25@...r.kernel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	taesoo@...ech.edu, insu@...ech.edu, csong84@...ech.edu,
	kjlu@...ech.edu
Subject: Re: [PATCH] fix a kernel infoleak in x25 module

From: Kangjie Lu <kangjielu@...il.com>
Date: Sun,  8 May 2016 12:10:14 -0400

> Stack object "dte_facilities" is allocated in x25_rx_call_request(),
> which is supposed to be initialized in x25_negotiate_facilities.
> However, 5 fields (8 bytes in total) are not initialized. This
> object is then copied to userland via copy_to_user, thus infoleak
> occurs.
> 
> Signed-off-by: Kangjie Lu <kjlu@...ech.edu>

Applied and queued up for -stable thanks.

Please start formatting your Subject lines properly, I've been fixing
all of them up by hand.

You should specify a subsystem name prefix, then a ":" character, then
a space, then a description of your change.  For example, for this
patch an appropriate Subject would have been:

	[PATCH] x25: Fix a kernel infoleak in x25_negotiate_facilities().

Thanks.