RE: CVE Request: Linux kernel information leak in event device handling

["Mehaffey, John" <John_Mehaffey () mentor com>]

> From: Marcus Meissner [meissner () suse de]
> Sent: Tuesday, January 20, 2015 6:43 AM
> To: OSS Security List
> Subject: [oss-security] CVE Request: Linux kernel information leak in event device handling
>
> Hi,
>
> This needs a CVE, information leak out of the kernel.
>
> This probably was introduced by commit 483180281f0ac60d1138710eb21f4b9961901294
> in Linux 3.9.
>
> Ciao, Marcus
>
> http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7c4f56070fde2367766fa1fb04852599b5e1ad35
> https://bugzilla.suse.com/show_bug.cgi?id=904899
>
> Input: evdev - fix EVIOCG{type} ioctl
>
> The 'max' size passed into the function is measured in number of bits
> (KEY_MAX, LED_MAX, etc) so we need to convert it accordingly before
> trying to copy the data out, otherwise we will try copying too much
> and end up with up with a page fault.
>
> Reported-by: Pavel Machek <pavel () ucw cz>
> Reviewed-by: Pavel Machek <pavel () ucw cz>
> Reviewed-by: David Herrmann <dh.herrmann () gmail com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov () gmail com>

I don't see how this could leak information to the user.

Without the patch, too much memory is allocated internally in the driver, and too much data is copied into that buffer 
(potentially causing a page fault) but the same, correct amount of data is copied out to the user both before and after 
this patch.

Sincerely,
John Mehaffey
Linux System Architect
Mentor Graphics