packet_getname_spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13. This structure is then copied
to userland. It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().
The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll. Set it to zero.
Signed-off-by: Vasiliy Kulikov <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
This was fixed by the commit below, this is already upstream and released in v2.6.37, therefore closing off for Natty:
commit 67286640f638f5a d41a946b9a3dc75 327950248f
Author: Vasiliy Kulikov <email address hidden>
Date: Wed Nov 10 12:09:10 2010 -0800
net: packet: fix information leak to userland
packet_ getname_ spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13. This structure is then copied
to userland. It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().
The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll. Set it to zero.
Signed-off-by: Vasiliy Kulikov <email address hidden>
Signed-off-by: David S. Miller <email address hidden>