[PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt

["Clément LECIGNE" <clement.lecigne@netasq.com>]

[-- Attachment #1: Type: text/plain, Size: 647 bytes --]

Hello lkml,

In function sock_getsockopt() located in net/core/sock.c, optval v.val is  
not correctly initialized and directly returned in userland in case we  
have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
         unsigned char buf[4] = { 0, 0, 0, 0 };
         int len;
         int sock;
         sock = socket(33, 2, 2);
         getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
         printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
         close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its  
declaration.

Bests,

-- 
Clément LECIGNE,
:%s/coin/& coin/g

[-- Attachment #2: sock.bsdcompat.patch --]
[-- Type: application/octet-stream, Size: 332 bytes --]

--- linux/net/core/sock.c        2008-11-26 14:37:17.000000000 -0800
+++ linux/net/core/sock.c        2008-11-26 14:37:45.000000000 -0800
@@ -695,6 +695,8 @@
        if (len < 0)
                return -EINVAL;
 
+       v.val = 0;
+
        switch(optname) {
        case SO_DEBUG:
                v.val = sock_flag(sk, SOCK_DBG);