Skip to content
Snippets Groups Projects
Commit 97857c67 authored by sanghyun.eom's avatar sanghyun.eom Committed by Sanghyun Eom
Browse files

sched: Fix information leak in sys_sched_getattr()


CVE-2014-9903

We're copying the on-stack structure to userspace, but forgot to give
the right number of bytes to copy. This allows the calling process to
obtain up to PAGE_SIZE bytes from the stack (and possibly adjacent
kernel memory).

This fix copies only as much as we actually have on the stack
(attr->size defaults to the size of the struct) and leaves the rest of
the userspace-provided buffer untouched.

Found using kmemcheck + trinity.

Signed-off-by: default avatarsanghyun.eom <sanghyun.eom@samsung.com>
parent d550156b
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment