[kernel] r17127 - in dists/squeeze/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Sun Mar 27 21:44:42 2011
New Revision: 17127

Log:
Bluetooth: sco: fix information leak to userspace (CVE-2011-1078)

Added:
   dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-sco-fix-information-leak-to-userspace.patch
Modified:
   dists/squeeze/linux-2.6/debian/changelog
   dists/squeeze/linux-2.6/debian/patches/series/32

Modified: dists/squeeze/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze/linux-2.6/debian/changelog	Sun Mar 27 21:25:18 2011	(r17126)
+++ dists/squeeze/linux-2.6/debian/changelog	Sun Mar 27 21:44:42 2011	(r17127)
@@ -48,6 +48,7 @@
      http://www.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.32/ChangeLog-2.6.32.34
      http://www.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.32/ChangeLog-2.6.32.35
   * drm/radeon/kms: check AA resolve registers on r300 (CVE-2011-1016)
+  * Bluetooth: sco: fix information leak to userspace (CVE-2011-1078)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Sat, 12 Mar 2011 20:20:58 +0000
 

Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-sco-fix-information-leak-to-userspace.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-sco-fix-information-leak-to-userspace.patch	Sun Mar 27 21:44:42 2011	(r17127)
@@ -0,0 +1,25 @@
+commit c4c896e1471aec3b004a693c689f60be3b17ac86
+Author: Vasiliy Kulikov <segoon at openwall.com>
+Date:   Mon Feb 14 13:54:26 2011 +0300
+
+    Bluetooth: sco: fix information leak to userspace
+    
+    struct sco_conninfo has one padding byte in the end.  Local variable
+    cinfo of type sco_conninfo is copied to userspace with this uninizialized
+    one byte, leading to old stack contents leak.
+    
+    Signed-off-by: Vasiliy Kulikov <segoon at openwall.com>
+    Signed-off-by: Gustavo F. Padovan <padovan at profusion.mobi>
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 960c6d1..926ed39 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -703,6 +703,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
+ 			break;
+ 		}
+ 
++		memset(&cinfo, 0, sizeof(cinfo));
+ 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
+ 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
+ 

Modified: dists/squeeze/linux-2.6/debian/patches/series/32
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/series/32	Sun Mar 27 21:25:18 2011	(r17126)
+++ dists/squeeze/linux-2.6/debian/patches/series/32	Sun Mar 27 21:44:42 2011	(r17127)
@@ -15,3 +15,4 @@
 + bugfix/all/drm-radeon-kms-check-aa-resolve-registers-on-r300.patch
 + bugfix/all/drm-radeon-fix-regression-with-aa-resolve-checking.patch
 + bugfix/all/stable/2.6.32.36.patch
++ bugfix/all/bluetooth-sco-fix-information-leak-to-userspace.patch