[PATCH 0/2] Fix info leaks on export for udf and isofs

[PATCH 0/2] Fix info leaks on export for udf and isofs

[Mathias Krause]

Al, Jan,

this patch set fixes info leaks in isofs and udf. Both file systems fail to
initialize all bytes of the f_handle byte array when creating a handle for a
path pointing to a directory. This memory gets copied to userland and that for
is a leak of uninitialized heap data to userland that should be fixed.

This info leak can be triggered locally by using the name_to_handle_at()
syscall.


Regards,


Mathias Krause (2):
  isofs: avoid info leak on export
  udf: avoid info leak on export

 fs/isofs/export.c |    1 +
 fs/udf/namei.c    |    1 +
 2 files changed, 2 insertions(+)

-- 
1.7.10.4

[PATCH 1/2] isofs: avoid info leak on export

[Mathias Krause]

For type 1 the parent_offset member in struct isofs_fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
 fs/isofs/export.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/isofs/export.c b/fs/isofs/export.c
index aa4356d..1d38044 100644
--- a/fs/isofs/export.c
+++ b/fs/isofs/export.c
@@ -134,6 +134,7 @@ isofs_export_encode_fh(struct inode *inode,
 	len = 3;
 	fh32[0] = ei->i_iget5_block;
  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
+	fh16[3] = 0;  /* avoid leaking uninitialized data */
 	fh32[2] = inode->i_generation;
 	if (parent) {
 		struct iso_inode_info *eparent;
-- 
1.7.10.4

[PATCH 2/2] udf: avoid info leak on export

[Mathias Krause]

For type 0x51 the udf.parent_partref member in struct fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
 fs/udf/namei.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 1802417..c31deb3 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1279,6 +1279,7 @@ static int udf_encode_fh(struct inode *inode, __u32 *fh, int *lenp,
 	*lenp = 3;
 	fid->udf.block = location.logicalBlockNum;
 	fid->udf.partref = location.partitionReferenceNum;
+	fid->udf.parent_partref = 0;
 	fid->udf.generation = inode->i_generation;
 
 	if (parent) {
-- 
1.7.10.4

Re: [PATCH 0/2] Fix info leaks on export for udf and isofs

[Jan Kara]

On Thu 12-07-12 08:46:53, Mathias Krause wrote:
> Al, Jan,
> 
> this patch set fixes info leaks in isofs and udf. Both file systems fail to
> initialize all bytes of the f_handle byte array when creating a handle for a
> path pointing to a directory. This memory gets copied to userland and that for
> is a leak of uninitialized heap data to userland that should be fixed.
> 
> This info leak can be triggered locally by using the name_to_handle_at()
> syscall.
  Thanks! I've merged both patches into my tree.

							Honza
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR