In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: fix potential stack infoleak in em_text_dump()<\/p>\n
em_text_dump() allocates struct tcf_em_text on the stack without zeroing
\nit. strscpy() writes the algorithm name and a NUL terminator into
\nconf.algo[], leaving the remaining bytes uninitialised. nla_put_nohdr()
\nthen copies the full struct to the netlink response.<\/p>\n
KMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path,
\none triggered via “tc filter show” and one via a raw RTM_GETTFILTER dump:<\/p>\n
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9\/0x2620
\n nla_put_nohdr+0x83\/0x130
\n em_text_dump+0x291\/0x550
\n Local variable conf created at: em_text_dump+0x5d\/0x550
\n Bytes 168-179 of 199 are uninitialized<\/p>\n
I am not certain whether this constitutes a real security problem in
\npractice: the test was conducted in a controlled KMSAN environment and
\nthe leaked stack bytes may or may not carry sensitive data on actual
\nproduction kernels. I am reporting it because KMSAN flagged it as a
\nkernel-infoleak and the fix is straightforward. I can provide a
\nuserspace reproducer on request.<\/p>\n
The original code used strncpy() which zero-pads to the destination size.
\nCommit b04202d6065c (“net\/sched: replace strncpy with strscpy”) replaced
\nit with strscpy(), which does not pad, creating this condition.
\nZero-initialising the struct closes it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: fix potential stack infoleak in em_text_dump()<\/p>\n
em_text_dump() allocates struct tcf_em_text on the stack without zeroing<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41056","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}