Commit df0bca04 authored by Clément Lecigne's avatar Clément Lecigne Committed by David S. Miller

net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2

In function sock_getsockopt() located in net/core/sock.c, optval v.val
is not correctly initialized and directly returned in userland in case
we have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
	unsigned char buf[4] = { 0, 0, 0, 0 };
	int len;
	int sock;
	sock = socket(33, 2, 2);
	getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
	printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
	close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its
declaration.
Signed-off-by: default avatarClément Lecigne <clement.lecigne@netasq.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 354b45ff
...@@ -696,6 +696,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname, ...@@ -696,6 +696,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
if (len < 0) if (len < 0)
return -EINVAL; return -EINVAL;
v.val = 0;
switch(optname) { switch(optname) {
case SO_DEBUG: case SO_DEBUG:
v.val = sock_flag(sk, SOCK_DBG); v.val = sock_flag(sk, SOCK_DBG);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment