• Marcel Holtmann's avatar
    [Bluetooth] Fix L2CAP and HCI setsockopt() information leaks · 0878b666
    Marcel Holtmann authored
    The L2CAP and HCI setsockopt() implementations have a small information
    leak that makes it possible to leak kernel stack memory to userspace.
    
    If the optlen parameter is 0, no data will be copied by copy_from_user(),
    but the uninitialized stack buffer will be read and stored later. A call
    to getsockopt() can now retrieve the leaked information.
    
    To fix this problem the stack buffer given to copy_from_user() must be
    initialized with the current settings.
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    0878b666
hci_sock.c 15.2 KB