Skip to content
Commit 0878b666 authored by Marcel Holtmann's avatar Marcel Holtmann
Browse files

[Bluetooth] Fix L2CAP and HCI setsockopt() information leaks



The L2CAP and HCI setsockopt() implementations have a small information
leak that makes it possible to leak kernel stack memory to userspace.

If the optlen parameter is 0, no data will be copied by copy_from_user(),
but the uninitialized stack buffer will be read and stored later. A call
to getsockopt() can now retrieve the leaked information.

To fix this problem the stack buffer given to copy_from_user() must be
initialized with the current settings.

Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent dc87c398
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment