TITLE:
Linux Kernel IPv4 "sockaddr_in.sin_zero" Information Disclosure

SECUNIA ADVISORY ID:
SA19357

VERIFY ADVISORY:
http://secunia.com/advisories/19357/

CRITICAL:
Not critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

OPERATING SYSTEM:
Linux Kernel 2.6.x
http://secunia.com/product/2719/
Linux Kernel 2.4.x
http://secunia.com/product/763/

DESCRIPTION:
Pavel Kankovsky has reported a weakness in the Linux kernel, which
can be exploited by malicious, local users to disclose potentially
sensitive information.

The weakness is caused due to the "sockaddr_in.sin_zero" array not
being zeroed before being returned to user space programs calling
certain socket functions to retrieve information about the specified
socket. This can be exploited to disclose six uninitialised bytes of
the kernel stack via calls to the "getsockopt()" function with the
"SO_ORIGINAL_DST" option, or via calls to the "getsockname()",
"getpeername()", and "accept()" functions.

The weakness has been reported in the 2.4 and 2.6 kernel branches.

NOTE: The weakness in the "getsockname()", "getpeername()", and
"accept()" functions affect only the 2.4 kernel.

SOLUTION:
The weakness have been fixed in the 2.4 kernel branch in the CVS
repositories.

Secunia is currently not aware of any official patches for the 2.6
kernel.

PROVIDED AND/OR DISCOVERED BY:
Pavel Kankovsky

ORIGINAL ADVISORY:
http://marc.theaimsgroup.com/?l=linux-netdev&m=114148078223594&w=2

Kernel.org:
http://www.kernel.org/git/?p=linux/kernel/git/marcelo/linux-2.4.git;a=commit;h=09d3b3dcfa80c9094f1748c1be064b9326c9ef2b

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------