Re: [PATCH 3.12 69/76] net: fix infoleak in rtnetlink

[Vegard Nossum]

On 19 May 2016 at 11:08, Jiri Slaby <jslaby@xxxxxxx> wrote:
> From: Kangjie Lu <kangjielu@xxxxxxxxx>
>
> 3.12-stable review patch.  If anyone has any objections, please let me know.
>
> ===============
>
> [ Upstream commit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6 ]
>
> The stack object âmapâ has a total size of 32 bytes. Its last 4
> bytes are padding generated by compiler. These padding bytes are
> not initialized and sent out via ânla_putâ.
>
> Signed-off-by: Kangjie Lu <kjlu@xxxxxxxxxx>
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> Signed-off-by: Jiri Slaby <jslaby@xxxxxxx>
> ---
>  net/core/rtnetlink.c | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index fd3a16e45dd9..5093f42d7afc 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -950,14 +950,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
>                 goto nla_put_failure;
>
>         if (1) {
> -               struct rtnl_link_ifmap map = {
> -                       .mem_start   = dev->mem_start,
> -                       .mem_end     = dev->mem_end,
> -                       .base_addr   = dev->base_addr,
> -                       .irq         = dev->irq,
> -                       .dma         = dev->dma,
> -                       .port        = dev->if_port,
> -               };
> +               struct rtnl_link_ifmap map;
> +
> +               memset(&map, 0, sizeof(map));
> +               map.mem_start   = dev->mem_start;
> +               map.mem_end     = dev->mem_end;
> +               map.base_addr   = dev->base_addr;
> +               map.irq         = dev->irq;
> +               map.dma         = dev->dma;
> +               map.port        = dev->if_port;
> +
>                 if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
>                         goto nla_put_failure;
>         }
> --
> 2.8.2
>

Just out of curiosity, was this observed in practice? I could be
wrong, but I was under the impression that using designated
initializers would zero the rest of the struct, including padding.
This seems to back that up:

http://stackoverflow.com/a/3374468/1697183

If this is indeed a real info leak, then I would assume we have much
bigger problems around the kernel.


Vegard