lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Mon, 15 Apr 2019 23:04:11 +0800
From:   Fuqian Huang <huangfq.daxian@...il.com>
To:     3chas3@...il.com, linux-atm-general@...ts.sourceforge.net,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Potential kernel address leakage in driver/atm.

Hi, recently I found that there is a kernel address leakage to user
space via copy_to_user in
drivers/atm/iphase.c:2772 (linux-5.0.7)
In ia_ioctl, when cmd is MEMDUMP_DEV, copy_to_user will copy struct
IADEV from ia_dev[board] to user space.
The struct is initialized in ia_init_one(line 3185/3211) and the pci
and next_board field are kernel pointers assigned in line 3191 and
3224.

Related code:
static int ia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
{
    ...
    iadev = kzalloc(...);
    ...
    iadev->pci =  pdev;
    ...
    iadev->next_board = ia_boards;
    ...
}

static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
{
    ...
    IADEV *iadev;
    ...
    iadev = ia_dev[board];
    ...
    switch (ia_cmds.cmd) {
        ...
        case MEMDUMP_DEV:
        ...
        if (copy_to_user(ia_cmds.buf, iadev, sizeof(IADEV)))
        ...
    }
}

Powered by blists - more mailing lists