[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CABXRUiRB0POW+i-Q5NAjbkBjStUZ9YVehk=dOsM-p7symuUgdQ@mail.gmail.com>
Date: Thu, 18 Apr 2019 21:33:59 +0800
From: Fuqian Huang <huangfq.daxian@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel < 4.14.111 drivers/net/wan/lmc/lmc_main.c kernel address
dumps to user space
In drivers/net/wan/lmc/lmc_main.c:510,
lmc_ioctl will dump the address of data to dmesg when xc.command is
lmc_xilinx_load, which allows local user to read the kernel address.
int lmc_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
{
...
case lmc_xilinx_load: /*fold02*/
...
printk("%s: Starting load of data Len: %d at 0x%p ==
0x%p\n", dev->name, xc.len, xc.data, data);
}
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
