[PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt

From: ClÃment LECIGNE
Date: Wed Feb 11 2009 - 10:21:18 EST


Hello lkml,

In function sock_getsockopt() located in net/core/sock.c, optval v.val is not correctly initialized and directly returned in userland in case we have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
unsigned char buf[4] = { 0, 0, 0, 0 };
int len;
int sock;
sock = socket(33, 2, 2);
getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its declaration.

Bests,

--
ClÃment LECIGNE,
:%s/coin/& coin/g

Attachment: sock.bsdcompat.patch
Description: Binary data