lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 08 May 2017 14:42:15 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     keescook@...omium.org
Cc:     netdev@...r.kernel.org, rasesh.mody@...ium.com,
        sudarsana.kalluru@...ium.com, linux-kernel@...r.kernel.org,
        Dept-GELinuxNICDev@...ium.com, danielmicay@...il.com
Subject: Re: [PATCH] bna: ethtool: Avoid reading past end of buffer

From: Kees Cook <keescook@...omium.org>
Date: Fri, 5 May 2017 15:30:23 -0700

> Using memcpy() from a string that is shorter than the length copied means
> the destination buffer is being filled with arbitrary data from the kernel
> rodata segment. Instead, use strncpy() which will fill the trailing bytes
> with zeros.
> 
> This was found with the future CONFIG_FORTIFY_SOURCE feature.
> 
> Cc: Daniel Micay <danielmicay@...il.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>

Applied.

Powered by blists - more mailing lists