Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 18 Apr 2019 21:31:36 +0800
From: Fuqian Huang <huangfq.daxian@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel < 4.14.111 drivers/media/dvb-frontends/helene.c kernel
 address dumps to user space

In drivers/media/dvb-frontends/helene.c:1005,
function helene_attach_s will print the address of
adapter to dmesg, the kernel address is dumpped to
user space.
struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
        const struct helene_config *config,
        struct i2c_adapter *i2c)
{
    ...
    priv->i2c = i2c;
    ...
    dev_info(&priv->i2c->dev,
            "Sony HELENE Sat attached on addr=%x at I2C adapter %p\n",
            priv->i2c_address, priv->i2c);
    return fe;
}

In drivers/media/dvb-frontends/helene.c:1041,
function helene_attach will print the address of
adapter to dmesg, the kernel address is dumpped to
user space.

struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
        const struct helene_config *config,
        struct i2c_adapter *i2c)
{
    ...
    priv->i2c = i2c;
    ...
    dev_info(&priv->i2c->dev,
            "Sony HELENE Ter attached on addr=%x at I2C adapter %p\n",
            priv->i2c_address, priv->i2c);
    return fe;
}

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.