tree 67515bc845a399c77df22dd859cabdb17dcd70ff
parent 44bd4de9c2270b22c3c898310102bc6be9ed2978
author Vasiliy Kulikov <segoon@openwall.com> 1297698563 +0100
committer Patrick McHardy <kaber@trash.net> 1297698563 +0100

bridge: netfilter: fix information leak

Struct tmp is copied from userspace.  It is not checked whether the "name"
field is NULL terminated.  This may lead to buffer overflow and passing
contents of kernel stack as a module name to try_then_request_module() and,
consequently, to modprobe commandline.  It would be seen by all userspace
processes.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>