[PATCH] CAN-2005-0400: ext2 mkdir() directory entry random kernel memory leak

ChangeSet 1.1481, 2005/03/25 17:23:04-03:00, [email protected]

	[PATCH] CAN-2005-0400: ext2 mkdir() directory entry random kernel memory leak
	
	I think I have discovered a potential security problem in ext2: when a
	new directory is created, the ext2 block written to disk is not
	initialized.
	
	An information leak can then be found after the two directory entries ('.'
	and
	'..') or in the name buffer of each entry (struct ext2_dir_entry_2).
	
	The following script can easily show the problem on Linux 2.4 and 2.6:
	
	#!/bin/sh
	FILE=foo
	dd if=/dev/zero of=$FILE bs=1k count=8192
	mke2fs -F -b 1024 -m0 $FILE
	mount -o loop $FILE mnt
	for D in `seq 500` ; do mkdir mnt/$D ; done
	umount mnt
	
	Using 'strings foo' will reveal the information leak in the file.



 dir.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)


diff -Nru a/fs/ext2/dir.c b/fs/ext2/dir.c
--- a/fs/ext2/dir.c	2005-03-25 20:04:20 -08:00
+++ b/fs/ext2/dir.c	2005-03-25 20:04:20 -08:00
@@ -524,7 +524,8 @@
 		goto fail;
 
 	base = page_address(page);
-
+	
+	memset(base, 0, chunk_size); 
 	de = (struct ext2_dir_entry_2 *) base;
 	de->name_len = 1;
 	de->rec_len = cpu_to_le16(EXT2_DIR_REC_LEN(1));