Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c813c3f authored by Marcel Holtmann's avatar Marcel Holtmann Committed by David S. Miller
Browse files

[NETFILTER]: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343) 



It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak (CVE-2006-1343).

Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d9ec5ad2

net/ipv4/netfilter/ip_conntrack_core.c

+1 −0
Original line number Diff line number Diff line
@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len) 
			.tuple.dst.u.tcp.port;

		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]

			.tuple.dst.ip;

		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));



		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",

		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

+1 −0
Original line number Diff line number Diff line
@@ -348,6 +348,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len) 
			.tuple.dst.u.tcp.port;

		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]

			.tuple.dst.u3.ip;

		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));



		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",

		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));