c7d573551f
NFT_META_BRI_IIFHWADDR declares its destination register with
len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to
two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does
memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and
leaving the upper 2 bytes of the second register as uninitialised
nft_do_chain() stack. A downstream load of that register span leaks
those stale bytes to userspace.
Zero the second register before the memcpy so the full declared span is
written.
Fixes:
|
||
|---|---|---|
| .. | ||
| ebt_802_3.c | ||
| ebt_among.c | ||
| ebt_arp.c | ||
| ebt_arpreply.c | ||
| ebt_dnat.c | ||
| ebt_ip.c | ||
| ebt_ip6.c | ||
| ebt_limit.c | ||
| ebt_log.c | ||
| ebt_mark.c | ||
| ebt_mark_m.c | ||
| ebt_nflog.c | ||
| ebt_pkttype.c | ||
| ebt_redirect.c | ||
| ebt_snat.c | ||
| ebt_stp.c | ||
| ebt_vlan.c | ||
| ebtable_broute.c | ||
| ebtable_filter.c | ||
| ebtable_nat.c | ||
| ebtables.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_bridge.c | ||
| nft_meta_bridge.c | ||
| nft_reject_bridge.c | ||