Vasiliy Kulikov 13283b73ca netfilter: arp_tables: fix infoleak to userspace ... commit 42eab94fff upstream. Structures ipt_replace, compat_ipt_replace, and xt_get_revision are copied from userspace. Fields of these structs that are zero-terminated strings are not checked. When they are used as argument to a format string containing "%s" in request_module(), some sensitive information is leaked to userspace via argument of spawned modprobe process. The first bug was introduced before the git epoch; the second is introduced by 6b7d31fc (v2.6.15-rc1); the third is introduced by 6b7d31fc (v2.6.15-rc1). To trigger the bug one should have CAP_NET_ADMIN. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2011-04-30 16:53:30 +02:00
..
9p	9p: fix put_data error handling	2008-09-24 16:22:22 -05:00
802	list_for_each_rcu must die: networking	2008-07-25 10:53:27 -07:00
8021q	net: fix packet socket delivery in rx irq handler	2009-02-06 14:00:36 -08:00
appletalk	appletalk: Fix skb leak when ipddp interface is not loaded (CVE-2009-2903)	2009-11-09 16:52:22 -08:00
atm	ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table	2008-12-13 15:29:17 -08:00
ax25	ax25: Fix possible oops in ax25_make_new	2010-04-01 15:52:18 -07:00
bluetooth	Bluetooth: bnep: fix buffer overflow	2011-04-30 16:53:29 +02:00
bridge	bridge: netfilter: fix information leak	2011-04-30 16:53:29 +02:00
can	can-bcm: fix minor heap overflow	2010-12-09 13:24:21 -08:00
core	filter: make sure filters dont read uninitialized memory	2011-04-30 16:53:03 +02:00
dccp	dccp: fix oops on Reset after close	2011-04-30 16:53:11 +02:00
decnet	DECnet: don't leak uninitialized stack byte	2010-12-09 13:24:19 -08:00
econet	econet: fix CVE-2010-3850	2010-12-09 13:24:21 -08:00
ethernet	[NET]: Return more appropriate error from eth_validate_addr().	2008-04-13 22:45:40 -07:00
ieee80211	wext: Emit event stream entries correctly when compat.	2008-06-16 18:50:49 -07:00
ipv4	netfilter: arp_tables: fix infoleak to userspace	2011-04-30 16:53:30 +02:00
ipv6	ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure	2010-12-09 13:24:20 -08:00
ipx	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
irda	irda: prevent heap corruption on invalid nickname	2011-04-30 16:53:26 +02:00
iucv	iucv: Fix mismerge again.	2008-09-30 03:03:35 -07:00
key	key: fix setkey(8) policy set breakage	2008-12-18 09:13:38 -08:00
lapb	[LAPB] net/lapb/lapb_iface.c: use LIST_HEAD instead of LIST_HEAD_INIT	2008-01-28 14:56:52 -08:00
llc	NET: llc, zero sockaddr_llc struct	2009-09-08 20:17:41 -07:00
mac80211	mac80211: initialize sta->last_rx in sta_info_alloc	2011-04-30 16:53:24 +02:00
netfilter	netfilter: nf_conntrack_tcp: fix unaligned memory access in tcp_sack	2009-05-02 10:23:53 -07:00
netlabel	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
netlink	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
netrom	netrom: Fix nr_getname() leak	2009-09-08 20:17:42 -07:00
packet	net: Make the copy length in af_packet sockopt handler unsigned	2009-10-05 08:11:47 -07:00
rfkill	rfkill: update LEDs for all state changes	2008-10-18 10:49:12 -07:00
rose	ROSE: prevent heap corruption with bad facilities	2011-04-30 16:53:27 +02:00
rxrpc	net/rxrpc: Use an IS_ERR test rather than a NULL test	2008-08-13 02:40:48 -07:00
sched	tc: Fix unitialized kernel memory leak	2010-04-01 15:52:24 -07:00
sctp	sctp: Fix oops when sending queued ASCONF chunks	2011-04-30 16:53:10 +02:00
sunrpc	SUNRPC: Ensure we always run the tk_callback before tk_action	2011-04-30 16:53:18 +02:00
tipc	tipc: Fix oops on send prior to entering networked mode (v3)	2010-07-05 11:08:47 -07:00
unix	net: unix: fix sending fds in multiple buffers	2010-04-01 15:52:18 -07:00
wanrouter	wanmain.c doesn't need syncppp.h	2008-07-23 23:00:36 +02:00
wireless	wext: fix potential private ioctl memory content leak	2010-10-28 21:04:15 -07:00
x25	x25: Do not reference freed memory.	2011-04-30 16:53:09 +02:00
xfrm	ipsec: Fix name of CAST algorithm	2009-07-30 16:06:12 -07:00
compat.c	flag parameters: paccept	2008-07-24 10:47:27 -07:00
Kconfig	net: Make "networking" one-click deselectable.	2008-07-30 03:27:53 -07:00
Makefile	vlan: uninline __vlan_hwaccel_rx	2008-07-08 03:23:36 -07:00
nonet.c
socket.c	net: Truncate recvfrom and sendto length to INT_MAX.	2010-12-09 13:24:20 -08:00
sysctl_net.c	missing bits of net-namespace / sysctl	2008-07-27 09:45:34 -07:00
TUNABLE