netdev - Re: [PATCH] can: bcm: fix infoleak in struct bcm_msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Jun 2021 09:20:58 +0200
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     Norbert Slusarek <nslusarek@....net>
Cc:     socketcan@...tkopp.net, davem@...emloft.net, kuba@...nel.org,
        linux-can@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH] can: bcm: fix infoleak in struct bcm_msg_head

On 12.06.2021 23:09:26, Norbert Slusarek wrote:
> From: Norbert Slusarek <nslusarek@....net>
> Date: Sat, 12 Jun 2021 22:18:54 +0200
> Subject: [PATCH] can: bcm: fix infoleak in struct bcm_msg_head
> 
> On 64-bit systems, struct bcm_msg_head has an added padding of 4 bytes between
> struct members count and ival1. Even though all struct members are initialized,
> the 4-byte hole will contain data from the kernel stack. This patch zeroes out
> struct bcm_msg_head before usage, preventing infoleaks to userspace.
> 
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: Norbert Slusarek <nslusarek@....net>

Added to linux-can/testing.

regards,
Marc

P.S.: I think the gmx web interface mangled the patch and converted tabs
to spaces. Try to use git send-mail to avoid this.

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)