Commit 50329c8a authored Aug 26, 2017 by Mathias Krause Committed by Steffen Klassert Aug 28, 2017

xfrm_user: fix info leak in xfrm_notify_sa()



The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the whole struct before filling
it.

Cc: Herbert Xu <herbert@gondor.apana.org.au>
Fixes: 0603eac0 ("[IPSEC]: Add XFRMA_SA/XFRMA_POLICY for delete notification")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 5fe0d4bd

net/xfrm/xfrm_user.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -2715,6 +2715,7 @@ static int xfrm_notify_sa(struct xfrm_state x, const struct km_event c)
		struct nlattr *attr;

		id = nlmsg_data(nlh);
		memset(id, 0, sizeof(*id));
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;

Admin message