info leak -- padded struct copied to user

From: Albert Cahalan (albert@users.sourceforge.net)
Date: Thu Jul 17 2003 - 18:34:32 EST


It's not OK to leak bits of the kernel stack.
(timy security flaw) I found this with -Wpadded.

diff -Naurd old/fs/stat.c new/fs/stat.c
--- old/fs/stat.c 2003-07-17 18:25:20.000000000 -0400
+++ new/fs/stat.c 2003-07-17 18:27:47.000000000 -0400
@@ -123,6 +123,7 @@
         SET_OLDSTAT_UID(tmp, stat->uid);
         SET_OLDSTAT_GID(tmp, stat->gid);
         tmp.st_rdev = stat->rdev;
+ tmp.__pad_16bit = 0; /* don't leak kernel stack data! */
 #if BITS_PER_LONG == 32
         if (stat->size > MAX_NON_LFS)
                 return -EOVERFLOW;
diff -Naurd old/include/asm-i386/stat.h new/include/asm-i386/stat.h
--- old/include/asm-i386/stat.h 2003-06-26 17:50:47.000000000 -0400
+++ new/include/asm-i386/stat.h 2003-07-17 18:23:01.000000000 -0400
@@ -9,6 +9,7 @@
         unsigned short st_uid;
         unsigned short st_gid;
         unsigned short st_rdev;
+ unsigned short __pad_16bit;
         unsigned long st_size;
         unsigned long st_atime;
         unsigned long st_mtime;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Jul 23 2003 - 22:00:31 EST