Bug 633158 - kernel: drivers/net/tulip/de4x5.c: reading uninitialized stack memory
Summary: kernel: drivers/net/tulip/de4x5.c: reading uninitialized stack memory
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 633159 633160 633161 633162 633163 633164 633165 633166
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-13 04:10 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:39 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-11-02 04:55:16 UTC
Embargoed:

Attachments (Terms of Use)

Description Eugene Teo (Security Response) 2010-09-13 04:10:09 UTC 
Description of problem:
http://lkml.org/lkml/2010/9/11/169
The DE4X5_GET_REG device ioctl allows unprivileged users to read 32 bytes of uninitialized stack memory, because it copies the uninitialized "addr" member instead of the intended "lval" member.
Comment 2 Eugene Teo (Security Response) 2010-09-16 02:37:26 UTC 
From Jeff Mahoney, 'tmp' is a union, not a struct. Writes to lval are the same as writes to addr. The length is correctly determined so that only initialized memory is used.

static int
de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
{   
    struct de4x5_private *lp = netdev_priv(dev);
    struct de4x5_ioctl *ioc = (struct de4x5_ioctl *) &rq->ifr_ifru;
    u_long iobase = dev->base_addr;
    int i, j, status = 0;
    s32 omr;
    union {
        u8  addr[144];
        u16 sval[72];
        u32 lval[36];
    } tmp;
[...]
Comment 3 Eugene Teo (Security Response) 2010-09-20 08:06:21 UTC 
Rejecting CVE-2010-3295.
Note You need to log in before you can comment on or make changes to this bug.