diff options
| author | Mathias Krause <minipli@googlemail.com> | 2017-08-26 17:09:00 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-11-11 13:34:33 +0000 |
| commit | 27558df8159c056fb5d84511b4aef3381cc93242 (patch) | |
| tree | ec8cfebcb8a1bbc12f2fa1ddead23f8e27d20562 /net | |
| parent | 2b666024123b0ba131d4fb2c3f7584ceb41feee6 (diff) | |
| download | linux-27558df8159c056fb5d84511b4aef3381cc93242.tar.gz linux-27558df8159c056fb5d84511b4aef3381cc93242.tar.bz2 linux-27558df8159c056fb5d84511b4aef3381cc93242.zip | |
xfrm_user: fix info leak in build_aevent()
commit 931e79d7a7ddee4709c56b39de169a36804589a1 upstream.
The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the sa_id before filling it.
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Fixes: d51d081d6504 ("[IPSEC]: Sync series - user")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 005c73ba4524..963222e89dbe 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1719,6 +1719,7 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct return -EMSGSIZE; id = nlmsg_data(nlh); + memset(&id->sa_id, 0, sizeof(id->sa_id)); memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr)); id->sa_id.spi = x->id.spi; id->sa_id.family = x->props.family; |