]> git.karo-electronics.de Git - karo-tx-linux.git/commit
Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
authorMathias Krause <minipli@googlemail.com>
Wed, 15 Aug 2012 11:31:48 +0000 (11:31 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 2 Oct 2012 17:38:41 +0000 (10:38 -0700)
commit352e3a79d7885339ea18c4bad77d4508616fa61c
tree9d4835aba4bcde59b7d23ed452726b07d9bd6fbe
parentd7b7aa589ccc3eed017f3b01f2f83004d47bdd85
Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)

[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]

The RFCOMM code fails to initialize the key_size member of struct
bt_security before copying it to userland -- that for leaking one
byte kernel stack. Initialize key_size with 0 to avoid the info
leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/bluetooth/rfcomm/sock.c