Several other ethtool functions leave heap uncleared (potentially) by drivers. Some interfaces appear safe (eeprom, etc), in that the sizes are well controlled. In some situations (e.g. unchecked error conditions), the heap will remain unchanged in areas before copying back to userspace. Note that these are less of an issue since these all require CAP_NET_ADMIN. ethtool_get_rxfh_indir (intro in a5b6ee29 v2.6.36-rc1) ethtool_get_rx_ntuple (intro in 15682bc4 v2.6.34-rc1) ethtool_get_regs changed to vmalloc in a77f5db3 v2.6.37-rc1 Upstream commit: http://git.kernel.org/linus/b00916b189d13a615ff05c9242201135992fcda3 Reference: https://lkml.org/lkml/2010/10/7/297 Acknowledgements: Red Hat would like to thank Kees Cook for reporting this issue.
ethtool_get_rxfh_indir (introduced in a5b6ee29 v2.6.36-rc1) ethtool_get_rx_ntuple (introduced in 15682bc4 v2.6.34-rc1) ethtool_get_regs -> changed to vmalloc in a77f5db3 v2.6.37-rc1 missing zeroing, posted a patch, see http://marc.info/?l=linux-kernel&m=129593098003553&w=2 ethtool_get_rx{fh_indir,_ntuple} are not backported to rhel-4/5/6/mrg-1. We just need to backport ethtool_get_regs() changes.
(In reply to comment #3) [...] > ethtool_get_rx{fh_indir,_ntuple} are not backported to rhel-4/5/6/mrg-1. We > just need to backport ethtool_get_regs() changes. http://git.kernel.org/linus/b7c7d01aaed1f71d9afe815a569f0a81465a1744
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0263 https://rhn.redhat.com/errata/RHSA-2011-0263.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0303 https://rhn.redhat.com/errata/RHSA-2011-0303.html
This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2011:0330 https://rhn.redhat.com/errata/RHSA-2011-0330.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0421 https://rhn.redhat.com/errata/RHSA-2011-0421.html