]> git.michaelhowe.org Git - packages/o/openafs.git/commit
OPENAFS-SA-2016-002 AFSStoreStatus information leak
authorBenjamin Kaduk <kaduk@mit.edu>
Sun, 13 Mar 2016 17:56:24 +0000 (12:56 -0500)
committerBenjamin Kaduk <kaduk@mit.edu>
Wed, 16 Mar 2016 04:03:33 +0000 (00:03 -0400)
commit90cb77f975244c77ef929be723e5b871247cbe9d
treeb2deb89fe2a6f980ed8afa2b1eb80deb7c604856
parent396240cf070a806b91fea81131d034e1399af1e0
OPENAFS-SA-2016-002 AFSStoreStatus information leak

Marc Dionne reported that portions of the AFSStoreStatus structure
were not written to before being sent over the network for
operations such as create, symlink, etc., leaking the contents
of the kernel stack to observers.  Which fields in the request
are used are controlled by a flags field, and so if a field was
not going to be used by the server, it was sometimes left
uninitialized.

Fix the information leak by zeroing out the structure before use.

FIXES 132847

Change-Id: Iebcac04d1ff70df06d054ddb3b886ab422fb2a14
src/WINNT/afsd/cm_dcache.c
src/afs/VNOPS/afs_vnop_attrs.c
src/afs/VNOPS/afs_vnop_create.c
src/afs/VNOPS/afs_vnop_dirops.c
src/afs/VNOPS/afs_vnop_symlink.c
src/afs/afs_disconnected.c
src/afs/afs_segments.c
src/libafscp/afscp_file.c
src/venus/afsio.c