Re: Information leak in sco_sock_bind

[Marcel Holtmann]

Hi Dave,

>> The following program leads to leak of 6 bytes from kernel stack:
> 
> This should fix it:
> 
> ====================
> [PATCH] bluetooth: Validate socket address length in sco_sock_bind().
> 
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> ---
> net/bluetooth/sco.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> index fe12966..f52bcbf 100644
> --- a/net/bluetooth/sco.c
> +++ b/net/bluetooth/sco.c
> @@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
> 	if (!addr || addr->sa_family != AF_BLUETOOTH)
> 		return -EINVAL;
> 
> +	if (addr_len < sizeof(struct sockaddr_sco))
> +		return -EINVAL;
> +
> 	lock_sock(sk);
> 
> 	if (sk->sk_state != BT_OPEN) {

thanks for the patch, but I think we do the same as we do with all the other Bluetooth socket and copy it into cleared stack variable. I have a patch for that and will ask Johan to send a pull request shortly.

Regards

Marcel

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/