econet: 4 byte infoleak to the network

struct aunhdr has 4 padding bytes between 'pad' and 'handle' fields on x86_64. These bytes are not initialized in the variable 'ah' before sending 'ah' to the network. This leads to 4 bytes kernel stack infoleak. This bug was introduced before the git epoch. Signed-off-by: Vasiliy Kulikov <[email protected]> Acked-by: Phil Blundell <[email protected]> Signed-off-by: David S. Miller <[email protected]>
goeke · Mar 18, 2011 · 67c5c6c · 67c5c6c
1 parent 4363c2f
commit 67c5c6c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
@@ -435,10 +435,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 		udpdest.sin_addr.s_addr = htonl(network | addr.station);
 	}
 
+	memset(&ah, 0, sizeof(ah));
 	ah.port = port;
 	ah.cb = cb & 0x7f;
 	ah.code = 2;		/* magic */
-	ah.pad = 0;
 
 	/* tack our header on the front of the iovec */
 	size = sizeof(struct aunhdr);