REDHAT-BUG-649715: Low severity red hat linux vulnerability
Description of problem: packetgetnamespkt() doesn't initialize all members of sadata field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sadata with strncpy() instead of strlcpy().
The same with packetgetname(): it doesn't initialize sllpkttype field of sockaddrll. Set it to zero.
Reference: http://marc.info/?l=linux-netdev&m=128854507220908&w=2 http://seclists.org/oss-sec/2010/q4/94
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-649715?
The severity of REDHAT-BUG-649715 is considered to be high due to the potential leakage of kernel stack memory.
How do I fix REDHAT-BUG-649715?
To fix REDHAT-BUG-649715, ensure that the sa_data field of the sockaddr struct is fully initialized using strncpy() when copying data to userland.
What systems are affected by REDHAT-BUG-649715?
REDHAT-BUG-649715 affects Red Hat Linux systems that rely on the packet_getname_spkt() function.
What are the potential risks of not addressing REDHAT-BUG-649715?
Failure to address REDHAT-BUG-649715 can lead to unauthorized access to sensitive information stored in kernel memory.
Is there a patch available for REDHAT-BUG-649715?
Yes, Red Hat has released patches to address REDHAT-BUG-649715, and users are encouraged to apply them.