tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

When processing Router Advertisements with user options the kernel
builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
has three padding fields that are never zeroed and can leak kernel data

The fix is simple, just zeroes the padding fields.

Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink (RDNSS support)")
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324224925.2437775-1-echelonh@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Yochai Eisenrich and committed by
Jakub Kicinski ae05340c 24280831

+3
+3
net/ipv6/ndisc.c
··· 1209 1209 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; 1210 1210 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; 1211 1211 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3; 1212 + ndmsg->nduseropt_pad1 = 0; 1213 + ndmsg->nduseropt_pad2 = 0; 1214 + ndmsg->nduseropt_pad3 = 0; 1212 1215 1213 1216 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3); 1214 1217