Commit e4d091d7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Pablo Neira Ayuso

netfilter: nfnetlink_{log,queue}: fix information leaks in netlink message

These structs have a "_pad" member.  Also the "phw" structs have an 8
byte "hw_addr[]" array but sometimes only the first 6 bytes are
initialized.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a206bcb3
...@@ -419,6 +419,7 @@ __build_packet_message(struct nfnl_log_net *log, ...@@ -419,6 +419,7 @@ __build_packet_message(struct nfnl_log_net *log,
nfmsg->version = NFNETLINK_V0; nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(inst->group_num); nfmsg->res_id = htons(inst->group_num);
memset(&pmsg, 0, sizeof(pmsg));
pmsg.hw_protocol = skb->protocol; pmsg.hw_protocol = skb->protocol;
pmsg.hook = hooknum; pmsg.hook = hooknum;
...@@ -498,7 +499,10 @@ __build_packet_message(struct nfnl_log_net *log, ...@@ -498,7 +499,10 @@ __build_packet_message(struct nfnl_log_net *log,
if (indev && skb->dev && if (indev && skb->dev &&
skb->mac_header != skb->network_header) { skb->mac_header != skb->network_header) {
struct nfulnl_msg_packet_hw phw; struct nfulnl_msg_packet_hw phw;
int len = dev_parse_header(skb, phw.hw_addr); int len;
memset(&phw, 0, sizeof(phw));
len = dev_parse_header(skb, phw.hw_addr);
if (len > 0) { if (len > 0) {
phw.hw_addrlen = htons(len); phw.hw_addrlen = htons(len);
if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw)) if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
......
...@@ -463,7 +463,10 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue, ...@@ -463,7 +463,10 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
if (indev && entskb->dev && if (indev && entskb->dev &&
entskb->mac_header != entskb->network_header) { entskb->mac_header != entskb->network_header) {
struct nfqnl_msg_packet_hw phw; struct nfqnl_msg_packet_hw phw;
int len = dev_parse_header(entskb, phw.hw_addr); int len;
memset(&phw, 0, sizeof(phw));
len = dev_parse_header(entskb, phw.hw_addr);
if (len) { if (len) {
phw.hw_addrlen = htons(len); phw.hw_addrlen = htons(len);
if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw)) if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment