TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
89df95ce32be204eef2e7d4b2f6fb552fb191a68
twx-linux/net
T
History
Norbert Slusarek 4fa028860b can: bcm: fix infoleak in struct bcm_msg_head 
commit 5e87ddbe39 upstream.

On 64-bit systems, struct bcm_msg_head has an added padding of 4 bytes between
struct members count and ival1. Even though all struct members are initialized,
the 4-byte hole will contain data from the kernel stack. This patch zeroes out
struct bcm_msg_head before usage, preventing infoleaks to userspace.

Fixes: ffd980f976 ("[CAN]: Add broadcast manager (bcm) protocol")
Link: https://lore.kernel.org/r/trinity-7c1b2e82-e34f-4885-8060-2cd7a13769ce-1623532166177@3c-app-gmx-bs52
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-30 08:48:52 -04:00
..
6lowpan
…
9p
…
802
…
8021q
net: vlan: avoid leaks on register_vlan_dev() failures
2021-01-17 13:58:58 +01:00
appletalk
appletalk: Fix skb allocation size in loopback case
2021-04-07 12:47:02 +02:00
atm
…
ax25
…
batman-adv
batman-adv: Avoid WARN_ON timing related checks
2021-06-30 08:48:48 -04:00
bluetooth
Bluetooth: use correct lock to prevent UAF of hdev object
2021-06-10 12:43:50 +02:00
bpf
…
bridge
net: bridge: use switchdev for port flags set through sysfs too
2021-03-07 11:27:43 +01:00
caif
net: caif: fix memory leak in cfusbl_device_notify
2021-06-10 12:43:51 +02:00
can
can: bcm: fix infoleak in struct bcm_msg_head
2021-06-30 08:48:52 -04:00
ceph
…
core
rtnetlink: Fix regression in bridge VLAN configuration
2021-06-30 08:48:49 -04:00
dcb
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
2021-01-23 15:48:46 +01:00
dccp
ipv6: weaken the v4mapped source check
2021-04-07 12:47:00 +02:00
decnet
…
dns_resolver
…
dsa
…
ethernet
…
hsr
hsr: use netdev_err() instead of WARN_ONCE()
2021-05-22 10:57:24 +02:00
ieee802154
net: ieee802154: fix null deref in parse dev addr
2021-06-30 08:48:45 -04:00
ife
…
ipv4
icmp: don't send out ICMP messages with a source address of 0.0.0.0
2021-06-30 08:48:51 -04:00
ipv6
udp: fix race between close() and udp_abort()
2021-06-30 08:48:49 -04:00
ipx
…
iucv
net/af_iucv: set correct sk_protocol for child sockets
2020-12-08 10:17:32 +01:00
kcm
…
key
af_key: relax availability checks for skb size calculation
2021-02-23 14:00:29 +01:00
l2tp
…
l3mdev
…
lapb
net: lapb: Copy the skb before sending a packet
2021-02-10 09:12:08 +01:00
llc
…
mac80211
mac80211: extend protection against mixed key and fragment cache attacks
2021-06-03 08:36:14 +02:00
mac802154
net: mac802154: Fix general protection fault
2021-04-16 11:57:52 +02:00
mpls
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2021-03-17 16:34:28 +01:00
ncsi
net/ncsi: Avoid GFP_KERNEL in response handler
2021-04-16 11:57:51 +02:00
netfilter
netfilter: synproxy: Fix out of bounds when parsing TCP options
2021-06-30 08:48:49 -04:00
netlabel
cipso,calipso: resolve a number of problems with the DOI refcounts
2021-03-17 16:34:29 +01:00
netlink
netlink: disable IRQs for netlink_lock_table()
2021-06-16 11:53:01 +02:00
netrom
…
nfc
net/nfc/rawsock.c: fix a permission check bug
2021-06-16 11:53:00 +02:00
nsh
…
openvswitch
openvswitch: fix stack OOB read while fragmenting IPv4 packets
2021-05-22 10:57:21 +02:00
packet
…
phonet
…
psample
…
qrtr
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
2021-03-30 14:40:12 +02:00
rds
net: rds: fix memory leak in rds_recvmsg
2021-06-30 08:48:49 -04:00
rfkill
…
rose
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-08 10:17:32 +01:00
rxrpc
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
2021-01-23 15:48:47 +01:00
sched
sch_dsmark: fix a NULL deref in qdisc_reset()
2021-06-03 08:36:25 +02:00
sctp
sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
2021-05-22 10:57:38 +02:00
smc
…
strparser
…
sunrpc
rpc: fix NULL dereference on kmalloc failure
2021-04-07 12:47:00 +02:00
switchdev
…
tipc
tipc: skb_linearize the head skb when reassembling msgs
2021-06-03 08:36:19 +02:00
tls
…
unix
net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
2021-06-30 08:48:51 -04:00
vmw_vsock
vsock/vmci: log once the failed queue pair allocation
2021-05-22 10:57:34 +02:00
wimax
…
wireless
cfg80211: mitigate A-MSDU aggregation attacks
2021-06-03 08:36:13 +02:00
x25
net/x25: Return the correct errno code
2021-06-30 08:48:47 -04:00
xfrm
xfrm: Fix oops in xfrm_replay_advance_bmp
2021-02-03 23:22:22 +01:00
compat.c
net: Return the correct errno code
2021-06-30 08:48:47 -04:00
Kconfig
…
Makefile
…
socket.c
…
sysctl_net.c
…