Attachment 56746 Details for Bug 132748

[patch] the patch

sys_get_thread_area-infoleak (text/plain), 1.17 KB, created by Olaf Kirch on 2005-11-09 09:06:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Kirch

Created: 2005-11-09 09:06:37 UTC

Size: 1.17 KB

patch

obsolete

>From: Blaisorblade <blaisorblade@yahoo.it>
>Date: Wed, 27 Jul 2005 18:45:18 +0000 (-0700)
>Subject: sys_get_thread_area does not clear the returned argument
>References: 132748
>X-Git-Tag: v2.6.13-rc4
>X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=71ae18ec690953e9ba7107c7cc44589c2cc0d9f1
>
>[PATCH] sys_get_thread_area does not clear the returned argument
>
>sys_get_thread_area does not memset to 0 its struct user_desc info before
>copying it to user space...  since sizeof(struct user_desc) is 16 while the
>actual datas which are filled are only 12 bytes + 9 bits (across the
>bitfields), there is a (small) information leak.
>
>Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
>Signed-off-by: Andrew Morton <akpm@osdl.org>
>Signed-off-by: Linus Torvalds <torvalds@osdl.org>
>Acked-by: okir@suse.de
>---
>
>--- a/arch/i386/kernel/process.c
>+++ b/arch/i386/kernel/process.c
>@@ -917,6 +917,8 @@ asmlinkage int sys_get_thread_area(struc
> 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
> 		return -EINVAL;
> 
>+	memset(&info, 0, sizeof(info));
>+
> 	desc = current->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
> 
> 	info.entry_number = idx;

Actions: View | Diff

Attachments on bug 132748: 56746