[PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt

[ClÃment LECIGNE]

Hello lkml,

In function sock_getsockopt() located in net/core/sock.c, optval v.val is  
not correctly initialized and directly returned in userland in case we  
have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
        unsigned char buf[4] = { 0, 0, 0, 0 };
        int len;
        int sock;
        sock = socket(33, 2, 2);
        getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
        printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
        close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its  
declaration.

Bests,

--
ClÃment LECIGNE,
:%s/coin/& coin/g

Attachment: sock.bsdcompat.patch
Description: Binary data