linux-kernel - [PATCH 10/11] iio: light: as73211: fix information leak in triggered buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241125-iio_memset_scan_holes-v1-10-0cb6e98d895c@gmail.com>
Date: Mon, 25 Nov 2024 22:16:18 +0100
From: Javier Carrasco <javier.carrasco.cruz@...il.com>
To: Jonathan Cameron <jic23@...nel.org>, 
 Lars-Peter Clausen <lars@...afoo.de>, 
 Antoni Pokusinski <apokusinski01@...il.com>, 
 Francesco Dolcini <francesco@...cini.it>, 
 João Paulo Gonçalves <jpaulo.silvagoncalves@...il.com>, 
 Gregor Boirie <gregor.boirie@...rot.com>
Cc: Jonathan Cameron <Jonathan.Cameron@...wei.com>, 
 linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org, 
 João Paulo Gonçalves <joao.goncalves@...adex.com>, 
 Francesco Dolcini <francesco.dolcini@...adex.com>, 
 Javier Carrasco <javier.carrasco.cruz@...il.com>, stable@...r.kernel.org
Subject: [PATCH 10/11] iio: light: as73211: fix information leak in
 triggered buffer

The 'scan' local struct is used to push data to userspace from a
triggered buffer, but it leaves the first channel uninitialized if
AS73211_SCAN_MASK_ALL is not set. That is used to optimize color channel
readings.

Set the temperature channel to zero if only color channels are
relevant to avoid pushing uninitialized information to userspace.

Cc: stable@...r.kernel.org
Fixes: 403e5586b52e ("iio: light: as73211: New driver")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@...il.com>
---
 drivers/iio/light/as73211.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/light/as73211.c b/drivers/iio/light/as73211.c
index be0068081ebb..99679b686146 100644
--- a/drivers/iio/light/as73211.c
+++ b/drivers/iio/light/as73211.c
@@ -675,6 +675,9 @@ static irqreturn_t as73211_trigger_handler(int irq __always_unused, void *p)
 				(char *)&scan.chan[1], 3 * sizeof(scan.chan[1]));
 		if (ret < 0)
 			goto done;
+
+		/* Avoid leaking uninitialized data */
+		scan.chan[0] = 0;
 	}
 
 	if (data_result) {

-- 
2.43.0