BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 22:37:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

xfrm_user: fix info leak in xfrm_notify_sa()

Browse Source 
The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the whole struct before filling
it.

Cc: Herbert Xu <[email protected]>
Fixes: 0603eac0d6 ("[IPSEC]: Add XFRMA_SA/XFRMA_POLICY for delete notification")
Signed-off-by: Mathias Krause <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
This commit is contained in:
Mathias Krause authored and Steffen Klassert committed 2017-08-28 10:58:02 +02:00
1 parent 5fe0d4bd8f
commit 50329c8a34
1 file changed
+1
Download Patch File Download Diff File Expand all files Collapse all files
net/xfrm/xfrm_user.c
+1
View File
@@ -2715,6 +2715,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
struct nlattr *attr;
id = nlmsg_data(nlh);
memset(id, 0, sizeof(*id));
memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
id->spi = x->id.spi;
id->family = x->props.family;