A kernel-infoleak bug in pppoe_getname() in drivers/net/ppp/pppoe.c
From: butt3rflyh4ck <hidden>
Date: 2021-11-03 16:14:45
Also in:
lkml
Subsystem:
networking drivers, ppp over ethernet, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Hi, I report a kernel-infoleak bug in pppoe_getname()) in drivers/net/ppp/pppoe.c. And we can call getname ioctl to invoke pppoe_getname(). ###anaylze
static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
int peer)
{
int len = sizeof(struct sockaddr_pppox);
struct sockaddr_pppox sp; ///---> define a 'sp' in stack but does
not clear it
sp.sa_family = AF_PPPOX; ///---> sp.sa_family is a short type, just
2 byte sizes.
sp.sa_protocol = PX_PROTO_OE;
memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
sizeof(struct pppoe_addr));
memcpy(uaddr, &sp, len);
return len;
}
There is an anonymous 2-byte hole after sa_family, make sure to clear it. ###fix use memset() to clear the struct sockaddr_pppox sp.
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 3619520340b7..fec328ad7202 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -723,6 +723,11 @@ static int pppoe_getname(struct socket *sock,
struct sockaddr *uaddr,
int len = sizeof(struct sockaddr_pppox);
struct sockaddr_pppox sp;
+ /* There is an anonymous 2-byte hole after sa_family,
+ * make sure to clear it.
+ */
+ memset(&sp, 0, len);
+
sp.sa_family = AF_PPPOX;
sp.sa_protocol = PX_PROTO_OE;
memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
The attachment is a patch. Regards, butt3rflyh4ck. -- Active Defense Lab of Venustech
Attachments
- 0001-net-ppp-pppoe-fix-a-kernel-infoleak-in-pppoe_getname.patch [text/x-patch] 1074 bytes · preview