Date: Wed, 5 Apr 2017 19:15:06 +0000 (UTC) From: Brooks Davis <brooks@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r316538 - stable/11/sys/kern Message-ID: <201704051915.v35JF64m022728@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: brooks Date: Wed Apr 5 19:15:06 2017 New Revision: 316538 URL: https://svnweb.freebsd.org/changeset/base/316538 Log: MFC r316497: Correct a kernel stack leak in 32-bit compat when vfc_name is short. Don't zero unused pointer members again. Per discussion with secteam we are not issuing an advisory for this issue as we have no current evidence it leaks exploitable information. Reviewed by: rwatson, glebius, delphij Sponsored by: DARPA, AFRL Modified: stable/11/sys/kern/vfs_subr.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/kern/vfs_subr.c ============================================================================== --- stable/11/sys/kern/vfs_subr.c Wed Apr 5 18:59:58 2017 (r316537) +++ stable/11/sys/kern/vfs_subr.c Wed Apr 5 19:15:06 2017 (r316538) @@ -3686,12 +3686,11 @@ vfsconf2x32(struct sysctl_req *req, stru { struct xvfsconf32 xvfsp; + bzero(&xvfsp, sizeof(xvfsp)); strcpy(xvfsp.vfc_name, vfsp->vfc_name); xvfsp.vfc_typenum = vfsp->vfc_typenum; xvfsp.vfc_refcount = vfsp->vfc_refcount; xvfsp.vfc_flags = vfsp->vfc_flags; - xvfsp.vfc_vfsops = 0; - xvfsp.vfc_next = 0; return (SYSCTL_OUT(req, &xvfsp, sizeof(xvfsp))); } #endif
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704051915.v35JF64m022728>