Commit 9824dfae authored Sep 12, 2018 by Willy Tarreau Committed by David S. Miller Sep 13, 2018

net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

Fields ->dev and ->next of struct ipddp_route may be copied to
userspace on the SIOCFINDIPDDPRT ioctl. This is only accessible
to CAP_NET_ADMIN though. Let's manually copy the relevant fields
instead of using memcpy().

BugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html


Cc: Jann Horn <jannh@google.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 018349d7

drivers/net/appletalk/ipddp.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		case SIOCFINDIPDDPRT:
		spin_lock_bh(&ipddp_route_lock);
		rp = __ipddp_find_route(&rcp);
		if (rp)
		memcpy(&rcp2, rp, sizeof(rcp2));
		if (rp) {
		memset(&rcp2, 0, sizeof(rcp2));
		rcp2.ip = rp->ip;
		rcp2.at = rp->at;
		rcp2.flags = rp->flags;
		}
		spin_unlock_bh(&ipddp_route_lock);

		if (rp) {