Commit 931e79d7 authored Aug 26, 2017 by Mathias Krause Committed by Steffen Klassert Aug 28, 2017

xfrm_user: fix info leak in build_aevent()



The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the sa_id before filling it.

Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Fixes: d51d081d ("[IPSEC]: Sync series - user")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent e3e5fc16

net/xfrm/xfrm_user.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1869,6 +1869,7 @@ static int build_aevent(struct sk_buff skb, struct xfrm_state x, const struct
	return -EMSGSIZE;		return -EMSGSIZE;

	id = nlmsg_data(nlh);		id = nlmsg_data(nlh);
			memset(&id->sa_id, 0, sizeof(id->sa_id));
	memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));		memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));
	id->sa_id.spi = x->id.spi;		id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;		id->sa_id.family = x->props.family;

Admin message