ipc: shm: fix information leak to userland
The shmid_ds structure is copied to userland with shm_unused{,2,3} fields unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Acked-by: Al Viro <viro@ZenIV.linux.org.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Родитель
504b701bb1
Коммит
3af54c9bd9
|
@ -479,6 +479,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
|
|||
{
|
||||
struct shmid_ds out;
|
||||
|
||||
memset(&out, 0, sizeof(out));
|
||||
ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
|
||||
out.shm_segsz = in->shm_segsz;
|
||||
out.shm_atime = in->shm_atime;
|
||||
|
|
Загрузка…
Ссылка в новой задаче