kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
No description
709,566 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Ben Seri 02462928e2 Bluetooth: Prevent stack info leak from the EFS element. 
commit 06e7e776ca upstream.

In the function l2cap_parse_conf_rsp and in the function
l2cap_parse_conf_req the following variable is declared without
initialization:

struct l2cap_conf_efs efs;

In addition, when parsing input configuration parameters in both of
these functions, the switch case for handling EFS elements may skip the
memcpy call that will write to the efs variable:

...
case L2CAP_CONF_EFS:
if (olen == sizeof(efs))
memcpy(&efs, (void *)val, olen);
...

The olen in the above if is attacker controlled, and regardless of that
if, in both of these functions the efs variable would eventually be
added to the outgoing configuration request that is being built:

l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs);

So by sending a configuration request, or response, that contains an
L2CAP_CONF_EFS element, but with an element length that is not
sizeof(efs) - the memcpy to the uninitialized efs variable can be
avoided, and the uninitialized variable would be returned to the
attacker (16 bytes).

This issue has been assigned CVE-2017-1000410

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2018-01-17 09:45:26 +01:00
arch KVM: PPC: Book3S HV: Always flush TLB in kvmppc_alloc_reset_hpt() 2018-01-17 09:45:24 +01:00
block block: don't let passthrough IO go into .make_request_fn() 2018-01-02 20:31:05 +01:00
certs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crypto crypto: algapi - fix NULL dereference in crypto_remove_spawns() 2018-01-17 09:45:23 +01:00
Documentation x86/kaslr: Fix the vaddr_end mess 2018-01-10 09:31:16 +01:00
drivers staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl 2018-01-17 09:45:26 +01:00
firmware License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs x86 / CPU: Always show current CPU frequency in /proc/cpuinfo 2018-01-10 09:31:20 +01:00
include bpf: prevent out-of-bounds speculation 2018-01-17 09:45:25 +01:00
init x86/mm/pti: Add infrastructure for page table isolation 2018-01-02 20:30:56 +01:00
ipc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
kernel bpf: arsh is not supported in 32 bit alu thus reject it 2018-01-17 09:45:25 +01:00
lib x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*' 2017-12-25 14:26:13 +01:00
mm mm/sparse.c: wrong allocation for mem_section 2018-01-10 09:31:17 +01:00
net Bluetooth: Prevent stack info leak from the EFS element. 2018-01-17 09:45:26 +01:00
samples samples/bpf: adjust rlimit RLIMIT_MEMLOCK for xdp1 2017-12-20 10:10:31 +01:00
scripts linux/compiler.h: Split into compiler.h and compiler_types.h 2017-12-25 14:26:33 +01:00
security apparmor: fix regression in mount mediation when feature set is pinned 2018-01-10 09:31:22 +01:00
sound ALSA: aloop: Fix racy hw constraints adjustment 2018-01-17 09:45:20 +01:00
tools bpf: arsh is not supported in 32 bit alu thus reject it 2018-01-17 09:45:25 +01:00
usr initramfs: fix initramfs rebuilds w/ compression after disabling 2017-11-03 07:39:19 -07:00
virt KVM: Fix stack-out-of-bounds read in write_mmio 2018-01-17 09:45:17 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: Add support to generate LLVM assembly files 2017-04-25 08:13:52 +09:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING [PATCH] update FSF address in COPYING 2005-09-10 10:06:29 -07:00
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS Merge branch 'akpm' (patches from Andrew) 2017-11-09 18:26:51 -08:00
Makefile Linux 4.14.13 2018-01-10 09:31:23 +01:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.