* [PATCH] fix infoleak in ioctl_cfg80211
@ 2016-05-03 22:11 Kangjie Lu
2016-05-03 23:05 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Kangjie Lu @ 2016-05-03 22:11 UTC (permalink / raw)
To: Larry.Finger
Cc: Jes.Sorensen, gregkh, linux-wireless, evel, linux-kernel, taesoo,
insu, csong84, Kangjie Lu
"mac" is an array allocated in stack without being initialized,
and will be sent out via "nla_put". The dump_station() is supposed
to initialize the mac address; otherwise, sensitive data in kernel
stack will be leaked. To fix this, either initialize it (e.g.,
memset) or completely remove this dump_station().
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
---
drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
index 12d1844..44a1582 100644
--- a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
@@ -2926,6 +2926,7 @@ static int cfg80211_rtw_dump_station(struct wiphy *wiphy,
/* TODO: dump scanned queue */
+ memset(mac, 0, ETH_ALEN);
return -ENOENT;
}
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] fix infoleak in ioctl_cfg80211
2016-05-03 22:11 [PATCH] fix infoleak in ioctl_cfg80211 Kangjie Lu
@ 2016-05-03 23:05 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2016-05-03 23:05 UTC (permalink / raw)
To: Kangjie Lu
Cc: Larry.Finger, Jes.Sorensen, linux-wireless, evel, linux-kernel,
taesoo, insu, csong84, Kangjie Lu
On Tue, May 03, 2016 at 06:11:46PM -0400, Kangjie Lu wrote:
> "mac" is an array allocated in stack without being initialized,
> and will be sent out via "nla_put". The dump_station() is supposed
> to initialize the mac address; otherwise, sensitive data in kernel
> stack will be leaked. To fix this, either initialize it (e.g.,
> memset) or completely remove this dump_station().
>
> Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
> ---
> drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
> index 12d1844..44a1582 100644
> --- a/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
> +++ b/drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c
> @@ -2926,6 +2926,7 @@ static int cfg80211_rtw_dump_station(struct wiphy *wiphy,
>
> /* TODO: dump scanned queue */
>
> + memset(mac, 0, ETH_ALEN);
> return -ENOENT;
> }
This isn't needed, as it returns -ENOENT and so mac never gets used.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-03 23:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-05-03 22:11 [PATCH] fix infoleak in ioctl_cfg80211 Kangjie Lu
2016-05-03 23:05 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).