| commit | fa0b3c99f7ce9972476a5fd99d0afbf9c9e46aff | |
| author | Vasiliy Kulikov <segooon@gmail.com> | |
| Wed, 10 Nov 2010 18:14:33 +0000 (10 10:14 -0800) | ||
| committer | Willy Tarreau <w@1wt.eu> | |
| Sat, 30 Apr 2011 14:53:33 +0000 (30 16:53 +0200) | ||
| tree | e0e852ecdfe5c483dbd73b21c5b82ce1e87ced46 | treesnapshot (tar.gz zip) |
| parent | a4a135545d178b09c3c57b75f43eab66e402b843 | commitdiff |
net: ax25: fix information leak to userland
commit fe10ae53384e48c51996941b7720ee16995cbcb7 upstream.
Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
field of fsa struct, also the struct has padding bytes between
sax25_call and sax25_ndigis fields. This structure is then copied to
userland. It leads to leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Moritz Muehlenhoff <jmm@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit fe10ae53384e48c51996941b7720ee16995cbcb7 upstream.
Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
field of fsa struct, also the struct has padding bytes between
sax25_call and sax25_ndigis fields. This structure is then copied to
userland. It leads to leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Moritz Muehlenhoff <jmm@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| net/ax25/af_ax25.c | diffblobblamehistory |