oss-security - Linux kernel < 4.14.111 drivers/media/dvb-frontends/horus3a.c kernel address dumps to user space

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABXRUiTOrkprr-vyV8enQaJFrDc7ho96JDHBzjYmK+wMY5KM6w@mail.gmail.com>
Date: Thu, 18 Apr 2019 21:31:52 +0800
From: Fuqian Huang <huangfq.daxian@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel < 4.14.111 drivers/media/dvb-frontends/horus3a.c kernel
 address dumps to user space

In drivers/media/dvb-frontends/horus3a.c:1005,
function horus3a_attach will print the address of
adapter to dmesg, the kernel address is dumpped to
user space.

struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
                    const struct horus3a_config *config,
                    struct i2c_adapter *i2c)
{
    ...
    priv->i2c = i2c;
    ...
    dev_info(&priv->i2c->dev,
        "Sony HORUS3A attached on addr=%x at I2C adapter %p\n",
        priv->i2c_address, priv->i2c);
    return fe;
}

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.