Please sign in to comment.
VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue()
In case we received no data on the call to skb_recv_datagram(), i.e. skb->data is NULL, vmci_transport_dgram_dequeue() will return with 0 without updating msg_namelen leading to net/socket.c leaking the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix this by moving the already existing msg_namelen assignment a few lines above. Cc: Andy King <email@example.com> Cc: Dmitry Torokhov <firstname.lastname@example.org> Cc: George Zhang <email@example.com> Signed-off-by: Mathias Krause <firstname.lastname@example.org> Signed-off-by: David S. Miller <email@example.com>
- Loading branch information...