0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Kernel: Fix info leak from sockaddr_un in socket syscalls

Browse source 
In `sys$accept4()` and `get_sock_or_peer_name()` we were not
initializing the padding of the `sockaddr_un` struct, leading to
an kernel information leak if the
caller looked back at it's contents.

Before Fix:

    37.766 Clipboard(11:11): accept4 Bytes:
    2f746d702f706f7274616c2f636c6970626f61726440eac130e7fbc1e8abbfc
    19c10ffc18440eac15485bcc130e7fbc1549feaca6c9deaca549feaca1bb0bc
    03efdf62c0e056eac1b402d7acd010ffc14602000001b0bc030100000050bf0
    5c24602000001e7fbc1b402d7ac6bdc

After Fix:

    0.603 Clipboard(11:11): accept4 Bytes:
    2f746d702f706f7274616c2f636c6970626f617264000000000000000000000
    000000000000000000000000000000000000000000000000000000000000000
    000000000000000000000000000000000000000000000000000000000000000
    0000000000000000000000000000000
This commit is contained in:
Brian Gianforcaro 2021-12-29 02:54:25 -08:00 • committed by Brian Gianforcaro
parent 98990dce53
commit 737a11389c
Notes: sideshowbarker 2024-07-17 22:00:21 +09:00
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Kernel/Syscalls/socket.cpp
View file

@ -108,7 +108,7 @@ ErrorOr<FlatPtr> Process::sys$accept4(Userspace<const Syscall::SC_accept4_params
VERIFY(accepted_socket);
if (user_address) {
sockaddr_un address_buffer;
sockaddr_un address_buffer {};
address_size = min(sizeof(sockaddr_un), static_cast<size_t>(address_size));
accepted_socket->get_peer_address((sockaddr*)&address_buffer, &address_size);
TRY(copy_to_user(user_address, &address_buffer, address_size));
@ -266,7 +266,7 @@ ErrorOr<void> Process::get_sock_or_peer_name(const Params& params)
auto& socket = *description->socket();
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
sockaddr_un address_buffer;
sockaddr_un address_buffer {};
addrlen_value = min(sizeof(sockaddr_un), static_cast<size_t>(addrlen_value));
if constexpr (sockname)
socket.get_local_address((sockaddr*)&address_buffer, &addrlen_value);