CVE-2011-1172: Infoleak

net/ipv6/netfilter/ip6tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAPNETADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.

— Launchpad

Structures ip6treplace, compatip6treplace, and xtgetrevision are copied from userspace. Fields of these structs that are zero-terminated strings are not checked. When they are used as argument to a format string containing "%s" in requestmodule(), some sensitive information is leaked to userspace via argument of spawned modprobe process.

The first bug was introduced before the git epoch; the second was introduced in 3bc3fe5e (v2.6.25-rc1); the third is introduced by 6b7d31fc (v2.6.15-rc1). To trigger the bug one should have CAPNETADMIN.

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.

Proposed patch:

http://git.kernel.org/?p=linux/kernel/git/kaber/nf-next-2.6.git;a=commitdiff;h=6a8ab060779779de8aea92ce3337ca348f973f54

— Red Hat