All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
	"David S. Miller" <davem@davemloft.net>,
	"Willy Tarreau" <w@1wt.eu>, "Jann Horn" <jannh@google.com>
Subject: [PATCH 3.16 06/16] net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
Date: Fri, 22 Mar 2019 05:20:18 +0000	[thread overview]
Message-ID: <lsq.1553232018.988169987@decadent.org.uk> (raw)
In-Reply-To: <lsq.1553232017.771830163@decadent.org.uk>

3.16.64-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Willy Tarreau <w@1wt.eu>

commit 9824dfae5741275473a23a7ed5756c7b6efacc9d upstream.

Fields ->dev and ->next of struct ipddp_route may be copied to
userspace on the SIOCFINDIPDDPRT ioctl. This is only accessible
to CAP_NET_ADMIN though. Let's manually copy the relevant fields
instead of using memcpy().

BugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/appletalk/ipddp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device
                 case SIOCFINDIPDDPRT:
 			spin_lock_bh(&ipddp_route_lock);
 			rp = __ipddp_find_route(&rcp);
-			if (rp)
-				memcpy(&rcp2, rp, sizeof(rcp2));
+			if (rp) {
+				memset(&rcp2, 0, sizeof(rcp2));
+				rcp2.ip    = rp->ip;
+				rcp2.at    = rp->at;
+				rcp2.flags = rp->flags;
+			}
 			spin_unlock_bh(&ipddp_route_lock);
 
 			if (rp) {


  parent reply	other threads:[~2019-03-22  5:23 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-22  5:20 [PATCH 3.16 00/16] 3.16.64-rc1 review Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 08/16] HID: debug: fix error handling in hid_debug_events_read() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 07/16] can: gw: ensure DLC boundaries after CAN frame modification Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 09/16] HID: debug: improve hid_debug_event() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 05/16] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 15/16] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 02/16] mm: cma: fix incorrect type conversion for size during dma allocation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 14/16] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 11/16] KVM: PPC: Move xics_debugfs_init out of create Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 01/16] xfs: don't BUG() on mixed direct and mapped I/O Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 13/16] KVM: use after free in kvm_ioctl_create_device() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 12/16] KVM: Protect device ops->create and list_add with kvm->lock Ben Hutchings
2019-03-22  5:20 ` Ben Hutchings [this message]
2019-03-22  5:20 ` [PATCH 3.16 10/16] HID: debug: fix the ring buffer implementation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 03/16] swiotlb: clean up reporting Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 04/16] sunrpc: use-after-free in svc_process_common() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 16/16] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Ben Hutchings
2019-03-22 13:44 ` [PATCH 3.16 00/16] 3.16.64-rc1 review Guenter Roeck
2019-03-23  4:43   ` Guenter Roeck
2019-03-24 23:25     ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1553232018.988169987@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=davem@davemloft.net \
    --cc=jannh@google.com \
    --cc=kda@linux-powerpc.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=w@1wt.eu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.