]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
isdn: Disable IIOCDBGVAR
authorKees Cook <keescook@chromium.org>
Wed, 15 Aug 2018 19:14:05 +0000 (12:14 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Aug 2018 05:44:55 +0000 (07:44 +0200)
commit445bff409b8170b1abb06d4932840a7c708292a1
tree4fbed52d05f749d2cd0784496fdb53882f2e402a
parent3f0f439a62e1ff8ebb2ba6792d7eee6d72020777
isdn: Disable IIOCDBGVAR

[ Upstream commit 5e22002aa8809e2efab2da95855f73f63e14a36c ]

It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/isdn/i4l/isdn_common.c