[linux] 01/01: rds: fix an infoleak in rds_inc_info_copy (CVE-2016-5244)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit 0249fe07bfc118fe251b7218c85f343fa7f47165
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu Jun 23 21:49:37 2016 +0200

    rds: fix an infoleak in rds_inc_info_copy (CVE-2016-5244)
---
 debian/changelog                                   |  1 +
 .../rds-fix-an-infoleak-in-rds_inc_info_copy.patch | 31 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 33 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index dac16ab..5f3174d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -31,6 +31,7 @@ linux (3.16.7-ckt25-2+deb8u1) UNRELEASED; urgency=medium
   * ALSA: timer: Fix leak in events via snd_timer_user_ccallback or
     snd_timer_user_tinterrupt (CVE-2016-4578)
   * tipc: fix an infoleak in tipc_node_get_links (CVE-2016-5243)
+  * rds: fix an infoleak in rds_inc_info_copy (CVE-2016-5244)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Wed, 30 Mar 2016 16:32:07 +0100
 
diff --git a/debian/patches/bugfix/all/rds-fix-an-infoleak-in-rds_inc_info_copy.patch b/debian/patches/bugfix/all/rds-fix-an-infoleak-in-rds_inc_info_copy.patch
new file mode 100644
index 0000000..fdc486b
--- /dev/null
+++ b/debian/patches/bugfix/all/rds-fix-an-infoleak-in-rds_inc_info_copy.patch
@@ -0,0 +1,31 @@
+From: Kangjie Lu <kangjielu at gmail.com>
+Date: Thu, 2 Jun 2016 04:11:20 -0400
+Subject: rds: fix an infoleak in rds_inc_info_copy
+Origin: https://git.kernel.org/linus/4116def2337991b39919f3b448326e21c40e0dbb
+
+The last field "flags" of object "minfo" is not initialized.
+Copying this object out may leak kernel stack data.
+Assign 0 to it to avoid leak.
+
+Signed-off-by: Kangjie Lu <kjlu at gatech.edu>
+Acked-by: Santosh Shilimkar <santosh.shilimkar at oracle.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/rds/recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index c0be1ec..8413f6c 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -561,5 +561,7 @@ void rds_inc_info_copy(struct rds_incoming *inc,
+ 		minfo.fport = inc->i_hdr.h_dport;
+ 	}
+ 
++	minfo.flags = 0;
++
+ 	rds_info_copy(iter, &minfo, sizeof(minfo));
+ }
+-- 
+2.8.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 95f4883..ccfc536 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -683,3 +683,4 @@ bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch
 bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_cca.patch
 bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_tin.patch
 bugfix/all/tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch
+bugfix/all/rds-fix-an-infoleak-in-rds_inc_info_copy.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git