Re: Re: Linux kernel: more net info leak fixes for v3.9

[Mathias Krause <minipli () googlemail com>]

On Mon, Apr 22, 2013 at 2:13 PM, P J P <ppandit () redhat com> wrote:
>   Hello,
> +-- On Mon, 22 Apr 2013, cve-assign () mitre org wrote --+
> | 9b3e617f3df53822345a8573b6d358f6b9e5ed87 CVE-2013-3222
>
> Is the following call sequence correct..?
>
>   recvmsg
>    -> __sys_recvmsg
>     -> sock_recvmsg_nosec/sock_recvmsg
>      -> __sock_recvmsg_nosec
>       -> sock->ops->recvmsg
>        -> vcc_recvmsg

looks reasonable

> If yes, *msg seems to hold the user space msghdr values. (Just to confirm)

partly... Have a look at verify_iovec()/verify_compat_iovec(). They're
updating the msg_name and msg_iov pointers.


Mathias