Re: [PATCH] isdn: Disable IIOCDBGVAR

From: David Miller
Date: Thu Aug 16 2018 - 15:26:48 EST


From: Kees Cook <keescook@xxxxxxxxxxxx>
Date: Wed, 15 Aug 2018 12:14:05 -0700

> It was possible to directly leak the kernel address where the isdn_dev
> structure pointer was stored. This is a kernel ASLR bypass for anyone
> with access to the ioctl. The code had been present since the beginning
> of git history, though this shouldn't ever be needed for normal operation,
> therefore remove it.
>
> Reported-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> Cc: Karsten Keil <isdn@xxxxxxxxxxxxxx>
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> ---
> netdev doesn't like explict stable markings, so I'll just ask here that it
> get included in -stable please. :)

Applied and queued up for -stable, thanks :)