![]() |
|
Message-ID: <CALV6CNPFCj_qyutH_ETc8=+ayLEEqbd9+_GA+VJMJOeuOS-_qg@mail.gmail.com> Date: Fri, 9 Sep 2022 12:52:44 +0800 From: Xingyuan Mo <hdthky0@...il.com> To: oss-security@...ts.openwall.com Subject: Linux kernel: information disclosure in stex_queuecommand_lck Hello, We found an information disclosure vulnerability in stex_queuecommand_lck() in drivers/scsi/stex.c through linux v6.0-rc4 which allows an attacker to disclose sensitive information such as kernel space address. This issue can be fixed with the following patch: https://lore.kernel.org/all/20220908145154.2284098-1-gregkh@linuxfoundation.org/ =*=*=*=*=*=*=*=*= Bug Details =*=*=*=*=*=*=*=*= In drivers/scsi/stex.c: 666: case PASSTHRU_CMD: 667: if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) { 668: struct st_drvver ver; 669: size_t cp_len = sizeof(ver); 670: 671: ver.major = ST_VER_MAJOR; 672: ver.minor = ST_VER_MINOR; 673: ver.oem = ST_OEM; 674: ver.build = ST_BUILD_VER; 675: ver.signature[0] = PASSTHRU_SIGNATURE; 676: ver.console_id = host->max_id - 1; 677: ver.host_no = hba->host->host_no; 678: cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len); 679: if (sizeof(ver) == cp_len) 680: cmd->result = DID_OK << 16; 681: else 682: cmd->result = DID_ERROR << 16; 683: done(cmd); 684: return 0; 685: } 686: break; The variable ver is declared off of the stack, but not zeroed out before copied back to user space, resulting in sensitive information disclosure. =*=*=*=*=*=*=*=*= Timeline =*=*=*=*=*=*=*=*= 2022-09-08: bug reported 2022-09-08: patch released =*=*=*=*=*=*=*=*= Credit =*=*=*=*=*=*=*=*= Xingyuan Mo (@hdthky) and Gengjia Chen (@chengjia4574) of IceSword Lab, 360 Best Regards, Xingyuan Mo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.