diff options
Diffstat (limited to 'extras/recipes-kernel/linux/linux-omap/linus/0038-CAN-Use-inode-instead-of-kernel-address-for-proc-fil.patch')
| -rw-r--r-- | extras/recipes-kernel/linux/linux-omap/linus/0038-CAN-Use-inode-instead-of-kernel-address-for-proc-fil.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/extras/recipes-kernel/linux/linux-omap/linus/0038-CAN-Use-inode-instead-of-kernel-address-for-proc-fil.patch b/extras/recipes-kernel/linux/linux-omap/linus/0038-CAN-Use-inode-instead-of-kernel-address-for-proc-fil.patch new file mode 100644 index 00000000..130a6407 --- /dev/null +++ b/extras/recipes-kernel/linux/linux-omap/linus/0038-CAN-Use-inode-instead-of-kernel-address-for-proc-fil.patch @@ -0,0 +1,43 @@ +From 177f55e48f91842a6e33e896d64ebb9a44db298b Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg <drosenberg@vsecurity.com> +Date: Sun, 26 Dec 2010 06:54:53 +0000 +Subject: [PATCH 38/65] CAN: Use inode instead of kernel address for /proc file + +Since the socket address is just being used as a unique identifier, its +inode number is an alternative that does not leak potentially sensitive +information. + +CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue. + +Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> +Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + net/can/bcm.c | 4 ++-- + 1 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 6faa825..9d5e8ac 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -125,7 +125,7 @@ struct bcm_sock { + struct list_head tx_ops; + unsigned long dropped_usr_msgs; + struct proc_dir_entry *bcm_proc_read; +- char procname [20]; /* pointer printed in ASCII with \0 */ ++ char procname [32]; /* inode number in decimal with \0 */ + }; + + static inline struct bcm_sock *bcm_sk(const struct sock *sk) +@@ -1521,7 +1521,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, + + if (proc_dir) { + /* unique socket address as filename */ +- sprintf(bo->procname, "%p", sock); ++ sprintf(bo->procname, "%lu", sock_i_ino(sk)); + bo->bcm_proc_read = proc_create_data(bo->procname, 0644, + proc_dir, + &bcm_proc_fops, sk); +-- +1.6.6.1 + |