History

af_key: fix info leaks in notify messages

key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners. Fix that.

Mathias Krause committed 13 years ago

Commit a5cc68f1 parent a963a371 file · +2 −0Browse files

Unified · Split

net/key/af_key.c+2−0
@@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c) · 1709 unmodified lines
1710 hdr->sadb_msg_version = PF_KEY_V2;1710 hdr->sadb_msg_version = PF_KEY_V2;
1711 hdr->sadb_msg_errno = (uint8_t) 0;1711 hdr->sadb_msg_errno = (uint8_t) 0;
1712 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));1712 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
1713 hdr->sadb_msg_reserved = 0;
1713 1714
1714 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);1715 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
1715 1716
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c) · 983 unmodified lines
2699 hdr->sadb_msg_errno = (uint8_t) 0;2700 hdr->sadb_msg_errno = (uint8_t) 0;
2700 hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;2701 hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2701 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));2702 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
2703 hdr->sadb_msg_reserved = 0;
2702 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);2704 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
2703 return 0;2705 return 0;
2704 2706