Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak

From: sohu0106
Date: Thu Aug 03 2017 - 10:03:09 EST




Sometimes irda_getsockopt() doesn't initialize all members of list field of irda_device_list struct. ÂThis structure is then copied to
userland. ÂIt leads to leaking of contents of kernel stack memory. Â

2 Ânet/irda/af_irda.c
@@ -2248,6 +2248,8 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 err = -EINVAL;
 goto out;
 }
+
+ memset( &list, 0, sizeof(struct irda_device_list) );
Â
 /* Ask lmp for the current discovery log */
 discoveries = irlmp_get_discoveries(&list.len, self->mask.word,


Â