netdev - Re: [patch] tehuti: using uninitialized data in bdx_ioctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130624.130145.1513695698751905735.davem@davemloft.net>
Date:	Mon, 24 Jun 2013 13:01:45 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	dan.carpenter@...cle.com
Cc:	andy@...yhouse.net, netdev@...r.kernel.org,
	kernel-janitors@...r.kernel.org
Subject: Re: [patch] tehuti: using uninitialized data in bdx_ioctl_priv()

From: Dan Carpenter <dan.carpenter@...cle.com>
Date: Mon, 24 Jun 2013 19:05:03 +0300

> If we "cmd == SIOCDEVPRIVATE" then we use data[] without initializing
> it.  The most common case is that we would return -EOPNOTSUPP.  The
> other case is that we'd end up reading and writing to randomish places.
> This requires CAP_SYS_RAWIO so it's not very bad.
> 
> The fix is to not allow SIOCDEVPRIVATE because it doesn't work.  I
> returned -EOPNOTSUPP instead of -ENOTTY because that's what is used in
> the rest of the file.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

I think the intention is to only allow SIOCDEVPRIVATE, rather than
accept any and all values other than it which are inside of the
private ioctl range.

The 'cmd' validation is one step, and it determines the interpretation
of data[0].
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html