[PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr
Sreeraj S Kurup <[email protected]>
| Newsgroups | gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
The 'header' structure is allocated on the stack and copied to userspace using copy_to_user(). Uninitialized fields and internal struct padding can leak random kernel stack data to userspace processes, creating an information disclosure vulnerability. Initialize 'header' to zero when declaring it so that all fields and padding bytes are fully cleared before copying to userspace. Signed-off-by: Sreeraj S Kurup <[email protected]> --- drivers/cdrom/cdrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 4f1fd389260f..f8c8dd4efa6c 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi, static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_tochdr header; + struct cdrom_tochdr header = {}; int ret; /* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */ -- 2.54.0