Bug 86258 – Kernel: potential mem pages leak in ext2 (CAN-2005-0400)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thierry Carrez (RETIRED) 2005-03-22 06:36:13 UTC]

Mathieu Lafon from Arkoon Network Security discovered the following problem in ext2: when a new directory is created, the ext2 block written to disk is not 
initialized. An information leak can then be found after the two directory entries ('.'  and '..') or in the name buffer of each entry (struct ext2_dir_entry_2).

Following fix has been published in 2.6.12-rc1-mm1 :

==============================================================
diff -rN -U 5 linux-2.6.10/fs/ext2/dir.c 
linux-2.6.10-ext2-info-leak-fix/fs/ext2/dir.c
--- linux-2.6.10/fs/ext2/dir.c  Wed Mar 16 18:16:51 2005
+++ linux-2.6.10-ext2-info-leak-fix/fs/ext2/dir.c       Wed Mar 16 
18:17:01 2005
@@ -590,10 +590,11 @@
        if (err) {
                unlock_page(page);
                goto fail;
        }
        kaddr = kmap_atomic(page, KM_USER0);
+       memset(kaddr, 0, chunk_size);
        de = (struct ext2_dir_entry_2 *)kaddr;
        de->name_len = 1;
        de->rec_len = cpu_to_le16(EXT2_DIR_REC_LEN(1));
        memcpy (de->name, ".\0\0", 4);
        de->inode = cpu_to_le32(inode->i_ino);
=============================================================

[Comment 1 solar (RETIRED) 2005-03-22 07:21:20 UTC]

This appears to be a 2.6.x only problem

[Comment 2 Thierry Carrez (RETIRED) 2005-03-26 09:20:02 UTC]

Fixed in vanilla 2.6.11.6
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.6

[Comment 3 Joshua Kinard 2005-04-23 22:27:19 UTC]

mips-sources fixed.

[Comment 4 Daniel Drake (RETIRED) 2005-04-27 13:43:00 UTC]

Fixed in gentoo-sources-2.6.11-r6

[Comment 5 Daniel Drake (RETIRED) 2005-04-29 17:39:56 UTC]

Fixed in usermode-sources-2.6.11

[Comment 6 Daniel Drake (RETIRED) 2005-05-10 15:32:47 UTC]

Fixed in ck-sources-2.6.11-r7

[Comment 7 Thierry Carrez (RETIRED) 2005-05-23 04:58:01 UTC]

This also affects the 2.4 series.

From solar :
grsec-sources-2.4.30 is in the tree as ~arch.

Note for other bumpers of 2.4.x series.
CAN-2004-1056.patch and linux-2.4.28-random-poolsize.patch have never 
been applied to mainline.

[Comment 8 Tim Yamin (RETIRED) 2005-08-20 11:14:12 UTC]

rsbac-sources requires patch.

[Comment 9 Tim Yamin (RETIRED) 2005-08-20 12:03:31 UTC]

kang: rsbac-2.6.11-r5 also appears to have a broken fix from upstream. From
1500_rsbac_1.2.4_20050528.patch:

++       memset(kaddr, 0, chunk_size);

... that should be one '+'.

[Comment 10 Tim Yamin (RETIRED) 2005-11-26 02:30:31 UTC]

All fixed, closing.