In sg_io, blk_rq_map_user{,_iov} may allocate a set of bounce buffer pages to do the bio, if it finds the user buffer cannot be directly mapped. But the allocated pages are not cleared. If the bounce buffer is also not written to by device, garbage data is left, and copied back to user in blk_rq_unmap_user. The allocated pages should be cleared. This also eliminates the risk of leaking sensitive information to userspace, which may have a security impact. This flaw is specific to RHEL-7 and does not affect the current upstream kernel.
Acknowledgments: Name: Fam Zheng (Red Hat)
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. This has been rated as having Low security impact as exploiting it requires privileged access and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.