lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4D166E9D.5080200@hartkopp.net> Date: Sat, 25 Dec 2010 23:22:21 +0100 From: Oliver Hartkopp <socketcan@...tkopp.net> To: Dan Rosenberg <drosenberg@...curity.com> CC: Urs Thuermann <urs.thuermann@...kswagen.de>, "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org, security@...nel.org Subject: Re: [PATCH] CAN: Use inode instead of kernel address for /proc file On 25.12.2010 23:16, Dan Rosenberg wrote: > Since the socket address is just being used as a unique identifier, its > inode number is an alternative that does not leak potentially sensitive > information. > > CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue. > > Signed-off-by: Dan Rosenberg <drosenberg@...curity.com> > Cc: stable <stable@...nel.org> Acked-by: Oliver Hartkopp <socketcan@...tkopp.net> Thanks Dan. > --- > net/can/bcm.c | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/can/bcm.c b/net/can/bcm.c > index 6faa825..5748901 100644 > --- a/net/can/bcm.c > +++ b/net/can/bcm.c > @@ -1520,8 +1520,8 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, > bo->bound = 1; > > if (proc_dir) { > - /* unique socket address as filename */ > - sprintf(bo->procname, "%p", sock); > + /* socket inode as filename */ > + sprintf(bo->procname, "%lx", sock_i_ino(sk)); > bo->bcm_proc_read = proc_create_data(bo->procname, 0644, > proc_dir, > &bcm_proc_fops, sk); > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists