https://github.com/torvalds/linux
Revision 0a0b98734479aa5b3c671d5190e86273372cab95 authored by Jann Horn on 11 May 2018, 00:19:01 UTC, committed by Linus Torvalds on 11 May 2018, 00:51:58 UTC
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex().  Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.

If do_adjtimex() doesn't write to ->tai (e.g.  because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Fix it by adding the memset() back.

Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 94d7dbf
History
Tip revision: 0a0b98734479aa5b3c671d5190e86273372cab95 authored by Jann Horn on 11 May 2018, 00:19:01 UTC
compat: fix 4-byte infoleak via uninitialized struct field
Tip revision: 0a0b987
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 12.8 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 9.2 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.3 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 287 bytes
MAINTAINERS -rw-r--r-- 441.9 KB
Makefile -rw-r--r-- 61.0 KB
README -rw-r--r-- 800 bytes

README

back to top